Just Lost My Site

[GovtLawyer]

I lost my site www.NYPetShots.com, on LunarPages last night. The browser connects to the server, the page title appears on top, and all I get is a blank page. I contacted LunarPages, and they got back to me 8 hours later, despite the urgency of my post. They claim the Home Page is not properly named, as it is home_page.html, and should be index.html.

This makes no sense as the site has been up and running al along. I did not change any code on the site.

So, I changed the page to index.html, and I was able to get the page, without any other attributes; no menu, no banners, no logos, no page colors. I was unable to use any links to my galleries . Inshort, I got a skeleton site. I changed it back.

Yesterday I enabled Spam Assassin. Lunar didn't ask me if I did anything at all which could cause this to SUDDENLY happen. Is it possible that clicking a button to enable SA could corrupt and bring down my site?

I need sdome help here. Does anyone have any clue as to what has happened and how to fix it? I am not using the lates version of Soho, I am using 4.85.r8

[GovtLawyer]

I have a Backup on Fantastico and I think the same one in the Web Builder, both going back to the same date in late August. While I've made a number of changes since then, if the fastest way to get back up is to perform a backup, I'll do it. Just walk me through the process.

Of course, since the pages were named the same in August as they were yesterday, I'm unsure what that would do, but I'm willing to try anything to get back up and running.

[lwyau]

home_page.html is not it. The start up "file" for the site is index.php, and it indeed produces a blank page.

I did notice that you can go into Soho admin via www.nypetshots.com/sohoadmin. (Incidentally you have an older version of Soho and should upgrade to the current one.)

I suggest you go into Sohoadmin to see if the site content is still there. The very act of logging into Sohoadmin refreshes all base files including index.php.

If this does not fix it, you may resort to restore, though it sounds like some environmental changes occurred with your host.

[GovtLawyer]

GOOD NEWS! Lunar fixed the problem. It was due to not having upgraded my web builder, so they say. Now, that means the server or something on Lunar's end was just changed, after all, the old version web builder worked for me yesterday, so why would it suddenly stop working? LunarPages upgraded the web builder, I think that's all they did, and VOILA! It must have been some environment change on their end, as you say, as it makes no sense for my old version to work yesterday and then to suddenly stop.

As they say . . . "The Squeaky Wheel Gets The Grease!" I squawked on the LunarForums and the problem was fixed. I knew it was nothing I did.

Now, go to www.nypetshots.com. I hope you'll agree it is a quality site, built by myself, a lay person without coding knowledge, using Soho and hosted by Lunar.

When it works, it works very well.

[GovtLawyer]

After getting my site back with a SOHO update, I just got the following message from LunarPages:

---------------------------------------------------------------------------------------------------
Hi,

During a recent security scan on your server, we found another following
script on
your account:

Script: /home/nypet2/public_html/Templates/html_form.php
Reason: c99 shell viewer

Script: /home/nypet2/public_html/sohoadmin/system_update.php
Reason: c99 shell viewer

Script: /home/nypet2/public_html/sohoadmin/config/logprox.php
Reason: c99 shell viewer

Script: /home/nypet2/public_html/sohoadmin/program/upgrade_web.php
Reason: c99 shell viewer

Script:
/home/nypet2/public_html/sohoadmin/program/wizard/shared/sohoaccess.php
Reason: c99 shell viewer

Script: /home/nypet2/public_html/PeopleAndPetsGallery/gallery.php
Reason: c99 shell viewer


This type of script is a file viewing/ssh script and has been disabled with
the extension _contact.support added to the end of it. Please remove this
script within 24 hours.

We appreciate your attention to this important matter to ensure server
security and stability.

-------------------------------------------------------------------------------------------------
The referenced files were created the day my site went down, so I'm wondering if they were the original cause. Obviously, I had nothing to do with their creation. My site works perfectly now, despite the fact that LunarPages disabled these files. Any idea what they are? How they got there? Can I safely delete them?

[lwyau]

These files were definitely planted by hackers when they managed to breach in your site. They are not part of Soho installation. You should delete them per your host.

Your host did a great service to you!

[GovtLawyer]

These files were definitely planted by hackers when they managed to breach in your site. They are not part of Soho installation. You should delete them per your host.

Your host did a great service to you!

Thanks for telling me this. So, would that explain how my site went down? If it is hackers, what can I do to keep them away, other than by changing my passwords? Also, what were the files intended to do? I have nothing of value on my site.

[Snipe]

Thanks for telling me this. So, would that explain how my site went down? If it is hackers, what can I do to keep them away, other than by changing my passwords? Also, what were the files intended to do? I have nothing of value on my site.


Keep it updated... upgrade to version r43..

They hacked mine a few weeks ago I was running r36.. Hackers just do it to annoy people..They just get there kicks out of screwing up peoples sites... You would think that with that type of intelligence they could put there talents to better use..

[GovtLawyer]

Keep it updated... upgrade to version r43..

They hacked mine a few weeks ago I was running r36.. Hackers just do it to annoy people..They just get there kicks out of screwing up peoples sites... You would think that with that type of intelligence they could put there talents to better use..

When LunarPages fixed my site they upgraded to the latest version of SohoLaunch. I've deleted the files they noted, and it had no affect on my site.

I changed my login infor for Lunarpages, to get into my CPanel and for SohoLaunch to get into my web builder. Do I need to password protect any single folder or file on my site? I note in CPAnel there is a password function, but it seems to me it requires anyone to use a password to view my site. Obviously, I want my site open to the public. However, it lists some SOHOADMIN folders as password protectable. Do I need to do that, or am I alright now?

Thanks for your help.