allie323

thanks so much for all the very helpful replies as to possible hosts and getting my blogs moved. I will update this post with the final outcome.

Oh- and cheerfully, I get no refund for the reminder of my contract.

I’ve paid the $30 for a restore, and was wondering if anyone could help me with how to get my blogs migrated to the new host? (once I find one) As I said earlier, I used their WordPress installer, so I don’t really know how to get it off of their server. Thank you again.

They appear to be simply ignoring me at this point. Throughout all of my experience with them, they respond to support tickets very quickly, within minutes in most cases. They haven’t responded to my current ticket in over 5 hours now. Great.

Thank you!!! Here is what I sent them:

“If you genuinely believe that WordPress has a vulnerability that allows this type of thing to happen, you owe it to the wider community to submit that information – without delay – to [email protected]. Until then, I really don’t see how you can blame WordPress or myself for this problem and I again ask for you to restore my data immediately at no cost to myself.”

Also, can anyone recommend a different host that I could check out? I use my host for 2 blogs, a large website, and storage for all of my pictures and videos.

Thanks for all of the very helpful assistance through this problem.

oooooh now I must apologize because I was NOT offended and I’m sorry if I sounded like I was!!! But I think that if I HAD chosen a server with no history and this happened, I would be somewhat more responsible than I feel I am. I hope that makes sense.

I’m still trying to convince them to do the restore for free, if they won’t budge by tonight, I’ll just pay the $30 and be done.

I pay by the year with them and have no idea if I have a contract. Somehow, I suspect that I do and I’ll have to pay to get out of it. ??

I do intend to move hosts as soon as I get my data back and running correctly. I am in no way defending my hosts, because I’m pretty pissed off at them, but I wouldn’t say they are fly by night. I’ve had service with them for 3 years without a bit of trouble until now. This particular trouble is bad enough that I’m done with them, but I feel like I need to defend myself by saying that I really wasn’t trying to cheap out or take the easy way or anything.

I still can’t get an answer out of them as to what “hole” was exploited or how to avoid this in the future other than “update every 2 weeks,” which like I said, I think is crap. I wish they could tell me where the problem occured so I can ensure it doesn’t happen again.

I have my logs but have no idea how to read them.

Nor can I get a satisfactory answer as to why I need to pay for a restore.

Yes, I have access to the database, but wouldn’t a new install overwrite anything that was still left?

I am still arguing with my host over payment of the $30. They say it is my fault because even though they provide WordPress through their server, it is my responsibility to update the software at least every 2 weeks, and that is why I was unprotected from whatever hole the hackers used.

I personally think that’s crap, but what do I know.

I cannot access my admin page. the file appears to be there when I look in FTP, but my dashboard appears to be MIA.

All I can get out of midphase is that it’s a wordpress hole. Very frustrated.

I don’t even know how to check the stupid log files. ??

Their response:

Alexis, unsuseful software only doesn’t have holes. That is why Fantastico
updates their “kernel” scripts and then allows to update the
installed scripts. In any case the intruder used some hole of your website,
becasue your website only was hacked. No one else has the similar problem.
Anyway, you asked me to explain why you website was hacked, I did supposition,
additionally I advised you to check your log files if you want to know how your
website was hacked.

…???

Oh, I may have misspoken. The host did not remove the files, but they appear to be missing, if that makes sense. I assumed the hackers removed them. I can’t get into my admin functions in wordpress. My other blog still works fine.

The hackers did sign the page.

I wrote my host back and asked for further explanation. I appreciate all the help.

I should add that WordPress is a host offered product. The install is all done through their interface. So I did not alter anything to use WordPress.

Here is what they said in reply:

Probably you blog has some hole. The intruder used that hole to hack your blog.
That is why we always advise to update all scritps from time to time and update
all life critical server side software. If you want to know why your blog was
hacked exactly, then I advise you to check your access_logs.

I will go check my logs.

I was running version 2.0.2, I believe.

I am admittedly clueless about security- can you make a guess at what went wrong for me? I pretty much assumed it was my fault.

Thanks.