Network Solutions Shared Hosting Hacked - And How To Fix It

Just wanted to share my experiences with you once again. There are a select number of companies on this planet that really seem to go out of the way to be obnoxiously bad at their jobs. Comcast, AIG, United Airlines - the familiar litany. Well, my experience with online hosting would put Network Solutions right up there with those in competition for the title 'Worst Company in America.'

Here's the current problem. Yesterday, May 14, 2009, at about 6:00AM, one of my users reported that my site had come up with a malware/virus alert on his computer. This was odd, as I am not a malware host. Further, my work computer had been infected the day before, though I had only visited reputable news sites; and my own site.

Lo and behold, upon investigation I found that my site had been hacked to carry the FakeAlert-CL trojan, which had the effect of causing my computer to pretend it had been badly hacked to get me to buy some spurious anti-virus software. Essentially, buying "protection" in the Mafia sense.

Luckily for me, this is not my first rodeo with Network Solutions' laughable excuse for security. This exact same thing had happened 18 months or so ago. I realized then that a worm had infected NS's shared hosting servers, and had changed every file with "index" anywhere in the title to include an < iframe > tag linking to a malware site (from which the computer would be infected).

So here's my workaround. I downloaded and repaired the three index files which control my site. I then deleted the infected files, and re-uploaded clean ones. Being prudent, and having experience with this, I also uploaded *backup* copies with different file names. This proved wise. NS has now been hacked 3 times in the last 18 hours in the exact same way. Each time I get hacked again, I simply delete the infected 'index' file and rename my backup to replace it, then upload a new backup for later use.

Some notes: this has affected my entire Movable Type system by corrupting the templates. However, it attacks only the base index.php file; if you simply fix that one file, then rebuild your Movable Type database, the offending code snippet will be removed. Secondarily, some sections of my site (my bulletin board, for instance) do not have 'index' in the title of their operative files. If I could remove every index file from my site and rename them, I would, but unfortunately too many of the components are hard-wired for that name. Finally, I tried CHMODing the index files to 444, which should have prevented even an Administrator from overwriting or changing them, but it had no effect.

So, back to NS. I contacted a person from NS' marketing department (who contacted me after I posted a previous complaint on this board) and let him know that I had been hacked. He told me he was referring me to "third level support" (meaning what? they speak better English?). I have since been hacked twice more, and have emailed this same PR guy both times. The last time I asked for a phone call; no shock, I have not yet heard back. Maybe this post will prompt a response.

At any rate, to those of you experiencing this with Network Solutions, hopefully my solution will help you. To those of you considering a hosting provider, DO NOT CHOOSE NETWORK SOLUTIONS.