Cumulus Support

Just a quick post as I am trying to fix things. The server was blocked and it appears Hetzner were right all along, once they told me what the likely malware was, I was able to find it and remove it. Now looking at stopping it recurring. No idea how it got in but Wordpress is a likely candidate. As far as I know no Cumulus users are using Wordpress, so the fault is either with me, Mrs L, or our friends. Apologies.

great work steve thank u and i was sooo pis off when i saw it went down

Ah the dreaded Wordpress!

I have seen thousands of bots trying to access Wordpress links on my site that simply don't exist.

Glad you've managed to resolve it though.

Hopefully I have prevented the malware from being activated now and have asked Hetzner to confirm that the server can stay up. They were actually very helpful once they had blocked the server.

I appeared to be down briefly this morning. I tried three sites on it and none functioned but back up now as at 12.30pm BST.

Very good news Steve and absolutely no apology required. Well done between you and Hetzner for finding the culprit.

This morning my Cumulus tray icon was blinking, and the error light got me to check. The log showed a continuous set of FTP timeout errors from 3:10 a.m. through 4:46 a.m., but none in the 2.5 hours since.

Somehow I failed to spot the last page of posts in this thread before posting this one--I've edited out my speculations first placed in this post.

I'll add a new query to my fellow users. I've personally used FireFTP as my file transfer method for my Cumulus site maintenance for years (and used to use it for other purposes). That appears to have died. Do you have any suggestions forWindows environments of preferred tools?

-direct command line FTP?
-FileZilla?

Something else?

I had intended to make a backup copy of stuff on my site provided by Steve before the plug was pulled, and got behind the power curve when FireFTP failed to present itself to me.

The bad news is that I haven't been able to find the source of the infection and it keeps reinstalling itself.

I have now blocked outgoing SMTP. This means that amongst other things, steve@sandaysoft.com will not work, and neither will forum registrations.

I have spent all day on this and now I am really really really pissed off.

These people who have nothing better to do than cause mayhem are a bloody disgrace. I feel for you Steve right in the middle of your holiday.

You may just have that Eureka moment and crack it. I hope the company are sympathetic to your plight and maybe offer some assistance.

I think I may have found it. No recurrence for well over an hour.

steve wrote:I think I may have found it. No recurrence for well over an hour.

Good lad! I had every faith in you.

If this hasn't sorted it, I'm calling in the big guns - Ken and Mark have both kindly offered to help.

I really do feel so sorry Steve for all the aggro you have suffered, especially while trying to enjoy your holiday.
Thank you so much for your wonderful work, how I wish I could help in some way.
There are sadly some evil people in this world.

Just try and enjoy the rest of your holiday or Mrs L will be on your case I will leave my query I have about something else till you get back !

Well done Steve, fingers crossed, now enjoy the rest of your holiday.