Last Friday, Winhost suspended my website and sent me the following email: Your account was found to contain one or more malicious files: cache.php ile.php dump.php Hackers were using these uploaded scripts in an attempt to compromise the server. Due to the severity of the issue, we have suspended web access. We suspect that the files were placed into your account without your knowledge through a file uploading application - either a third party file uploader, one that you wrote yourself or a known vulnerability with your application. Whether you wrote it yourself or it is a third party app, IT IS IMPORTANT THAT YOU MAKE THE CHANGES NECESSARY TO SECURE THE FILE UPLOADER, or your account will likely be used again to install malicious files onto the server. *** Need help? *** If you are unsure of how to secure your site or would like a deeper analysis and removal of any additional compromises that we can detect, we have a new site cleaning service that you may want to take advantage of. In addition to analysis and removal of compromises, we may also recommend further methods that you can employ to increase your site security. The site cleaning service is available for an hourly fee. If you're interested in having us do the work we would be happy to provide a cost estimate. Note: please do not remove the malicious files if you want us to perform site cleaning service. We need them to determine how the hacker uploaded the files. Thank you for your attention to this matter. WinHost Since then, I have had independent IT experts examine the website for viruses, run diagnostics - they have given my website the all clear and secured the website. I have since contacted winhost, since yesterday afternoon, having sent them three emails - and they have not replied. My website is the backbone of my business, without which, people will not be able to find me. Having my website therefore suspended, has been detrimental to my business. Winhost have been very unhelpful - they emailed me after I had the website first examined by an independent IT team, telling me that some viruses could still be found on the website, but refused to tell me which files were infected, so I could have them removed. Instead, they kept pushing on to me, their services. I am still waiting for a reply from them, so I my website can be reinstated, so I can run my business. Their service has not been impressive, and I have been researching other hosts to look after my website for me. After this experience with them, I can't say that I would recommend their services to anybody else. This has been a headache. 24/7 services? I think not.
We understand that, sorry. We don't like suspending sites. But please understand that having your website compromised and used in attempts to compromise the web server is detrimental to our business, and the hundreds of other sites that share a server with you. Which is why we have to take steps to prevent compromised sites from doing any harm (or any further harm). We can't give you a list of every compromised file on the site because we don't run deep analytics on the site. We detect certain known files and alert you to the overall problem. A deeper scan or help clearing up the problem is a service that we do provide, and of course you're free to take it or leave it. Not providing you a complete list of every possibly compromised file isn't an effort to get you to use the service, it's a function of the service. Sorry it's been a headache for you, that's never our intention.
Hi Michael, Thank you for your response. The delays in responses to emails was difficult to deal with. Had we known how easy it would have been just to have winhost fix the issues right from The beginning, we would have immediately had them do it, rather than refer it to our IT support team. We have since had the problem fixed, and the website has been reinstated.
Replies to suspended site issues may take longer than a regular support reply because they require the attention of a smaller team of abuse and compromise specialists. We're not ignoring you, and we're definitely sensitive to the problems caused by a site suspension. We address each case as quickly as we can.
