Account Suspended! Says shell scripts when i dont have any :(

[satyadeep.1991]

I am trying to restore my blog from a old backup .zip file (6 MB) when suddenly it stopped. I checked my account then only to find that its suspended due to shell scripts which I don't have any. I am just running a wordpress blog.

Please unsuspend my account

 

[Jarryd]

Filename: /home/satys/public_html/jayadeep.uni.cc/blog/wp-includes/class-feeds.php

Plenty of shell related file occurrences in there. Care to explain? c99 shell specifically?

 

[satyadeep.1991]

I don't know how they have come up there and I have no idea what's C99 is.
In the past someone intruded the blog and displayed their page as home page which was later removed by me. May be those scripts should have crept in then.

---------- Post added at 08:52 PM ---------- Previous post was at 08:13 PM ----------

Help!!!?

 

[Bryon]

Here is the log from this suspension: http://bryon.development.x10hosting.com/chopin.class-feeds.04-08-2010.15-48-26

 

[satyadeep.1991]

Hello!
I understand that the scripts have crept in, but as I said before I really don't know how they have come in. Why do I hack my own site ??!!
I wll clean it up and put a fresh wordpress installation . kindly unsuspend my account
Thanks.

---------- Post added at 02:29 PM ---------- Previous post was at 10:10 AM ----------

Can I get my database backup and files backup, if you guys are not happy with my explanation in unsuspending it?

Thanks.

 

[Livewire]

Judging by that it's still suspended after 2 staff have come through, I'm going to bet this is still covered under x10hosting's Zero Tolerance policy leaving the account permanently suspended with no backups.

For the future, if you were to get compromised again, nuke wordpress, keep only the database backup, and use fresh install with fresh files and everything. Also make sure to scan the database; some of the hacks used in the past actually inject the hack into the database so even on a fresh install, it still screws it up.

 

[satyadeep.1991]

Punished for an issue with no fault of mine!
How could i get a new x10 hosting account in this case then?
Because it is the best free hosting provider I have known

 

[Jarryd]

Hello,

Since i am feeling kind today i'm going to unsuspend your hosting account. I ask you to IMMEDIATELY remove your wordpress installation and upload a clean installation and start from scratch as your backups you were uploading are full of the prohibited content. If you do not comply within 24 hours you will be permanently suspended from x10hosting for good.

 

[satyadeep.1991]

Thats really so nice of you. Thank you Hell sheep. I have deleted the wordpress installation. I will put a FRESH installation soon.
I learnt one important fact --"Do an antivirus check of the backup before uploading".

---------- Post added at 12:11 PM ---------- Previous post was at 12:03 PM ----------

I don't think there is any problem with another addon domain satyadeep.tk
So I left it intact. What do you say?

 

[Jarryd]

Hello, it was only that wordpress install that was infected a far as i can see. You should be right to go.