Закрытие сайта - Ucoz - Сообщество uCoz

Сообщение # 1 | 17:22:42 22 Дек 2015

Пришло письмо от Ucoz
Здравствуйте!

На Вашем сайте было обнаружено вредоносное ПО.
От Вас ожидается удаление всех материалов, которые могут быть расценены как нарушающие пользовательское соглашение.

Текст жалобы:

---— Original Message —-—
> From: abuse@clean-mx.de <abuse@clean-mx.de>
> To: abuse@advancedhosters.com
> Cc: csirtuk@cpni.gsi.gov.uk
> 10:43:19 PM
> Subject: [clean-mx-viruses-84241121](213.174.157.194)-->(abuse@advancedhosters.com)
viruses sites (1 so far) within your network, please close them! status: As of
2015-12-18 21:43:19 CET
> Dear abuse team,

> please have a look on these perhaps offending viruses sites(1) so far.

> Notice: We do NOT urge you to shutdown your customer, but to inform
> him about a possible infection/misbehavior !

> status: As of 2015-12-18 21:43:19 CET

> Please preserve on any reply our Subject:
> [clean-mx-viruses-84241121](213.174.157.194)-->(abuse@advancedhosters.com)
> viruses sites (1 so far) within your network, please close them!
> status: As of 2015-12-18 21:43:19 CET

> http://support.clean-mx.de/clean-mx/viruses.php?email..@advancedhosters[..]

> (for full uri, please scroll to the right end ...

> This information has been generated out of our comprehensive real
> time database, tracking worldwide viruses URI's

> If your review this list of offending site(s), please do this
> carefully, pay attention for redirects also!
> Also, please consider this particular machines may have a root kit installed !
> So simply deleting some files or dirs or disabling cgi may not really solve the issue !

> Advice: The appearance of a Virus Site on a server means that
> someone intruded into the system. The server's owner should
> disconnect and not return the system into service until an
> audit is performed to ensure no data was lost, that all OS and
> internet software is up to date with the latest security fixes,
> and that any backdoors and other exploits left by the intruders
> are closed. Logs should be preserved and analyzed and, perhaps,
> the appropriate law enforcement agencies notified.

> DO NOT JUST DELETE THE FILES. IF YOU DO NOT FIX THE SECURITY
> PROBLEM, THEY WILL BE BACK!

> You may forward my information to law enforcement, CERTs,
> other responsible admins, or similar agencies.

> +---------------------------------------------------------------------------------------------—

> |date |id |virusname |ip |domain
|Url|
> +---------------------------------------------------------------------------------------------—
> |2015-12-17 05:24:07 CET |84241121
> |HTML:Malware.Generic(Shepherd)!1.A285 [F]|213.174.157.194
> |samp-mod.ru |http://samp-mod.ru/
> +---------------------------------------------------------------------------------------------—

> Your email address has been pulled out of whois concerning this offending network
block(s).
> If you are not concerned with anti-fraud measurements, please
> forward this mail to the next responsible desk available...

> If you just close(d) these incident(s) please give us a feedback,
> our automatic walker process may not detect a closed case

> explanation of virusnames:
> ==========================
> unknown_html_RFI_php not yet detected by scanners as RFI, but pure php code for
injection
> unknown_html_RFI_perl not yet detected by scanners as RFI, but pure perl code for
injection
> unknown_html_RFI_eval not yet detected by scanners as RFI, but
> suspect javascript obfuscationg evals
> unknown_html_RFI not yet detected by scanners as RFI, but
> trapped by our honeypots as remote-code-injection
> unknown_html not yet detected by scanners as RFI, but suspious,
> may be in rare case false positive
> ...javascript.insert Please pay attention for script code after </html>
> unknown_exe not yet detected by scanners as malware, but high risk!
> all other names malwarename detected by scanners
> ==========================

>yours

> Gerhard W. Recher
> (CTO)

> net4sec UG (haftungsbeschraenkt)

> Leitenweg 6
> D-86929 Penzing

> GSM: ++49 171 4802507

> Geschaeftsfuehrer: Martina Recher
> Handelsregister Augsburg: HRB 27139
> EG-Identnr: DE283762194

> w3: http://www.clean-mx.de
> e-Mail: mailto:abuse@clean-mx.de
> PGP-KEY: Fingerprint: A4E317B6DC6494DCC9616366A75AB34CDD0CE552 id: 0xDD0CE552
> Location:
> http://www.clean-mx.de/downloads/abuse-at-clean-mx.de..

Убедительно прошу, во избежание блокировки Вашего сайта, прокомментировать данную ситуацию и сообщить о проделанных действиях ответным письмом на протяжении 48-и часов.
Отсутствие ответного письма приведет к блокировке Вашего сайта.

С уважением, Татьяна
Служба технической поддержки веб-сервиса uCoz

На Virustotal проверил сайт вот показывает http://prntscr.com/9h81wo, раньше не было такого
Че вправду вирус где то засел? Что делать? Помогите.
Сайт Samp-Mod.Ru

Сообщение отредактировал Myxa3095 - Вторник, 22 Дек 2015, 17:31:51

Страница 1 из 1 1
Модератор форума: dotbot