Hacked (and not a PHP script hack)

[conard]

A site I host (clawhon.com) keeps getting hacked. They are not using any PHP scripts from what they say. In the root level (www) "a.exe" and "i.html" keeps popping up even though they delete them daily. The files look like they are spyware and their unique visitors that are accessing these files are 200,000+.

Please help!

[Jonathan]

If you have a recent copy of your site, I'd say delete EVERYTHING,
reset the password in WHM, and then upload each file after you've checked it manually.

Make sure no hidden backdoors. Besides that, thats only thing I can think of.

[Buddha]

[edit]Yeah ... what Jonathan said!

Looks like your site was flash based? Your flash site didn't need any backend access to database or anything? If you don't think it was a script exploit then the other possibilities are (in order of likelihood):

1. Some else you gave access too?
2. Home computer compromised?
3. Server compromised?

First start at home make sure your computer isn't compromised and then change your account passwords. Revoking all other user access in the process. If the server was compromised you wouldn't be the only one effected ... so check WHT.

[thinkliberty]

Did you look at the access logs to make sure that it's not a script?

[Pedja]

Send trouble ticket to support and ask them to investigate who and when accessed site in period you know it was hacked. That info could lead to attacker and means he used to attack you.

[Jonathan]

[edit]Yeah ... what Jonathan said!

Can you repeat that?

Send trouble ticket to support and ask them to investigate who and when accessed site in period you know it was hacked. That info could lead to attacker and means he used to attack you.

Wow, support does that? Is it free/paid?
Dathorn keeps getting better and better.

[Pedja]

:
Wow, support does that? Is it free/paid?

Once I had suspiction that account was compromised I asked them for help and they did help. They looked for me what IP's were used to access that account. Noone mentioned payment.

[Jonathan]

Nice