All the sites are asking for password

[OlegB]

Not long time ago a lot of Plesk servers have been affected by a virus that we suppose went through Mail Enable. We have found solution for this issue. The article with the solution is published

http://kb.swsoft.com/article_0_1716_en.html

If you have something new to add to get it fixed as more as possible you are welcome. Please reply on this thread.

 

[js1904]

Mailenable 19.8 + ME10027 patch

Hi Oleg

Sorry for the wrong post - just delete that one.

This kind of information, is what I call urgent info. Don't you have some kind of mailing list for urgent vulnerable patches?

What if standard ME 1.98 + 10027 patch i installed from mailenable.com, will this correct the error? We have some problem that all plesk servers - after fresh install 8.1.x can't boot to safemode. That's why I'm asking.

I've reinstalled the server 4-5 times because of this.. :|

Last install was yesterday, and after this I'm still running

Regards
Jacob Schmidt

 

[OlegB]

We did not face the problem that server can not boot in safe mode.
The article in this thread contains ME 10027 hotfix. It helped many servers to release from the virus.

 

[js1904]

I belive it has - and our servers too. Unfortunaly I had to reinstall some times before I found your thread. This cost me and my crew a lot of hours in the last five days.

Why don't you inform this kind of infomation on a hotfix newsletter or something?

Regards
Jacob Schmidt
CEO
EZE IT A/S

 

[Leighm0]

I thought this might be the issue with our server, however it is not, and I cannot fix the "All sites are asking for password" issue. I checked the local security policy but that "Access this computer from network" is not infact empty, it contains users, I ran a virus check with various antivirus software, also checked for those files in the windows directory which are the virus but they did not exist, so I thought I would run the me-fix anyway, so I did, rebooted etc, and still the same issue with all sites have user/password box..

I think something has screwed up the authentication in IIS etc, is there a way to fix this? I tried running the Plesk setup program from add/remove programs and clicked on the "Repair" option and it just sat there and after a while it would say "Internal Error 2856. Start_Installation_Dialog" and then Fatal Error - Installation ended prematurely becuase of an error.

If i check Event Viewer it would have these items after trying to run the repair option:
Source: MsiInstaller
Event ID: 11729
Description:
Product: Plesk 8.1 for Microsoft Windows -- Configuration failed.

Any help would be appreciated.

 

[OlegB]

Please try
C:\Program Files\SWsoft\Plesk\admin\bin>websrvmng.exe --update-anon-passwords-all

This command resets the password for all Plesk IUSR_ users in the system and IIS.

Also could you send at least one link to the problem web sites that asks for password. It's not clear why it is so.

 

[Leighm0]

Unfortunately that command didn't fix it.

https://75.126.127.186:8443/

is the plesk admin login.

Also just visiting:

http://75.126.127.186/

Asks for a user/password.

The server is not currently setup for the right DNS on the domains, as due to this problem we had to move the sites back to our older server.

 

[Leighm0]

I also ran the reconfigurator program to check plesk installation and it went thru it successfully but the log at the end and in event viewer under Plesk it has:

System.Exception: Class not registered (COM Error 80040154) at thumbprintIIsCertificate()
at psaobsolete.PSAHosting.switchPSAHosting(String type, Boolean force)
at reconfigurator.CheckPleskServices.Run()

 

[dwdietz]

passwords due to me virus

well nothing worked for mine. .I am at my colo reinstalling it now.. Well its a godo time to upgrade to plesk 8.1 always a bright side.

 

[Leighm0]

Yer I had to do an OS-Reload on the server to fix it.. took a plesk backup etc first and dumped to spare server and just restoring it now.

 

[autoweb]

Godaddy Solution

Godaddy claimed that my server blue screened. They reprovisioned my server and I'm still down. Been down for a week. Save yourself some grief. Do not host a non-managed server with GoDaddy for any reason. They will make mistakes which affect the server and leave you sitting for days at the time.

Anyone know of a decent hosting company. I want to move my dedicated server, and I want a new registrar for my 50+ domains.

 

[dwdietz]

Well this virus did cause blue screens until you disable the "Mail enable SMTP Relay service" and reboot

It was hairy and ugly. I had to rebuild mine

 

[Traged1]

What do you mean it is infected with a virus, which virus? A virus scan of the entire file system and memory returns no infections??

I just installed a PLESK 8.1.1 for Window server 2003 on a brand new clean server and applied all updates and now all sites ask asking for a login. WTF

 

[Traged1]

I also applied the file http://kb.swsoft.com/article_0_1716_en.html but it did not fix the issue, the users are all listed in the local policy but I am still being prompted for all websites.

 

[Traged1]

This issue did not arise until I put a password protections on a single directory using PLESK, are you sure that there is not a bug in the "Protected Directories" function of PLESK 8.1.1 For Windows Server 2003? Anyone else notice this?

 

[Traged1]

Actually, come to think about it, just before this happened, I finished installing ColdfusionMX7 to this server. I seem to recall this happening with PLESK 7.5 a ways back. Do you think that the Coldfusion install is restting PLESK's permissions once again on 8.1.1??

 

[Traged1]

Yep, I have confirmed this BUG, it is due to installing ColdfusionMX 7.02 Enterprise on the PLESK 8.1.1 For Windows server 2003.

Now how do we fix it, as we have many Coldfusion customers who need thier server back. This should be escalated please!!

 

[Traged1]

Super, all we needed to do is run the PLESK reconfiguirator program and it fixed the issue for us. WhooHoo!!

 

[Traged1]

Ok, I spoke too soon,

the reconfigurator, fixed the PLESK control panel login page from promting us to login, but the actual domains are still asking for a login. Additionally, PLESK is not recognizing the Coldfusion install. the coldfusion service is installed and running but plesk does not have it listed in the components section.

Anyone got any idea's?

 

[Traged1]

Ok I rolled back to PLESK 8.1.0 And it is still happening, so this must be an issue with the new ColdfusionMX 7.02 Windows binary which is available from Adobe.

I will try an older Windows Binary from one of our other servers to see if this is correct?