Tuesday, July 22, 2008

Network Solutions Hosting Server has a Worm

After many recent back-and-forth emails with Network Solution's Customer no-Service Department, it became clear to me that one of their main hosting servers is infected with a worm and HUNDREDS of sites are now infected as a result.

Go ahead, do the search in Google for "alenaprosti". You'll be surprised at the number of infected sites.

Network Solutions still has the nerve to tell me my "permissions settings are incorrect" when in fact it is their server that is infected. I sent them a list of about the first 70 sites from the Google results, of which 99% were on the server with IP 205.178.145.65.

Are you one of the hundreds affected. I hope so - then we can revolt! I smell a lawsuit cooking already.

Digg It!Digg It!

9 comments:

Anonymous said...

Viva La Revolution!

I'm taking my website elsewhere. NS has made me mad for the last time!

Unknown said...

Our site has been infected by the same worm. Google has dropped me from the search engine list of "church software" etc. It make me wonder if this worm is the reason why I have been dropped. I paid network solutions $2300 to optimize the search engines only to have me dropped. I am worse off now than before. I am not interested at this point in a law suit, but I would very much like to get this resolved.

My .htaccess file does in fact have a rewrite to alenaprosti and there are at least 10 invalid Google links that tie me to the worm. We spend another $675 dollars with Network Solutions for site-safe and Watch Dog. I have changed passwords on my ftp account. Network technical support advised me to let engineering fix the problem. It was reported on Wed. 6-23 and today is Saturday the 6-26-08. I have called them twice and they tell me that the service request is being looked into.

afitspot said...

Hi, my name is Gerry and I work at Network Solutions. I am disturbed to hear that we may have a worm, and I am going to check into this immediately. I will be back as soon as I get some information. Please feel free to contact me at SMedia (at) networksolutions.com

Unknown said...

I am having the same problem with a client's website. Funny, network solutions told us that is was with the permission settings as well. Maybe that is their default answer to this problem. We are going to switch hosting providers, this totally sucks. When i called back today asking, they said it was something else... This is first i've heard of this worm, glad you have information about it. Thanks!

afitspot said...

Hi, It's Gerry again. Sorry it took so long to get all my facts together.

We take security very seriously and routinely perform audits of our customers’ site content for potential vulnerabilities. Through a routine scan of Network Solutions customers’ web sites, we identified an individual that was redirecting traffic from our customers’ websites to another website. We have closed this person’s account and are cleaning up any customer sites affected by the ‘alenaprosti’ signature. This issue was precipitated by third party software that was downloaded by customers for their site. Once downloaded, third party software can create technical issues like the ‘alenaprosti’ issue.

Although Network Solutions audits, scans for, and addresses such issues, it is important for customers to continuously update third party software to maintain security on that software that is not marketed or controlled by Network Solutions. We encourage our customers to regularly review their web site’s code and alert us if they uncover any issues.

Please contact me directly at Smedia [at] networksolutions.com if you have any other questions or concerns.

James of all Trades said...

What 3rd party software specifically?? My files were hacked by a script with permissions ABOVE my htdocs folder.

Peter Ripley said...

James, thank you for posting on this.

Thank you gerard for commenting.

Would like to see this corrected and a statement issued by NS.

Currently a search for alenaprost returns almost 9000 hits, so there are lots of sites infected...

leah said...

Thanks for posting this. Not only did my site have this worm, but the whole site was completely down a couple of times. Network Solutions never copped to the problem, and instead wanted to charge us an extra fee every month for their secure hosting package.

Needless to say, we moved to another webhosting service in early July. After reading this, though, I feel like we should be getting a refund from Network Solutions.

Anonymous said...

Most webhosting companies set up accounts or on a shared server. You essentially share the total hard drive and bandwidth allowance with many others.