СРОЧНО! У кого провайдер Ростелеком или Домолинк?

Господа, у кого остались проблемы и кто на ростелекоме или домолинке, отзовитесь.
Нужно будет найти минутку времени сделать пару тестов...
Свяжитесь плс. со мной в личке или в скайпе moderator-home я подскажу, что и где набрать для проверки...

 

Я обновил первый пост...
Не поленитесь прочесть, прям целый детектив криминальный блин намечается...<br /><br />-- добавлено: 19 дек 2012, 17:45 --<br /><br />

Во первых ошибочка вышла... Не сразу понял я, как грамотно меня на хабре развели!
боРАНам реальный зачет! Молодцы! Порадовали отдуши первый раз за много времени, обычно затасканные ходы и даже фразы, унылые примелькавшиеся лица и т.д. А тут такая комбинация...
По этому безусловно учту...
Просто пора уже начинать расширять фронты по борьбе за альтернативную энергию на популярные сайты, а тут без опыта никак...

 

Дя я задавал подобные вопросы.. Но их зафлудили тут же!
Я напрямую писал, что мол Вы предлагаете мне на добровольных началах у РТ поадминить на пол ставки, что бы найти все их проблемы и т.д... Но зафлудили мгновенно и накидали минусов в карме.

На хабре публика странная, много горячей молодежи, которая сама ничего не знает и ничего и никого не уважает, но я к ней немного приспособился. А тут реальные бойцы...

Если поизучаете данную тему, то увидите, что на сайтах, где посещаемость выше 100к в сутки, эти темы оч. жестко мониторятся и отсекаются...
Почитайте мои темы по этой теме на том же чипмейкере, и т.д.
Там сразу налетает стая троллей! <br /><br />-- добавлено: 19 дек 2012, 20:02 --<br /><br />О! Абузы посыпались!
Причем совершенно левые...
Приведу ее сюда целиком.
Данные фрица скорее всего вымышленные, но мало ли...

Спойлер: Абуза

We have received information about spam or abuse from abuse@clean-mx.de. Please take all necessary measures to avoid this in the future.

Furthermore we request that you send a short response within 24 hours to us and to the complainant. This response should contain information about how this could have happened and what you intend to do about it.

How to proceed:
- Solve the problem
- Send a response to us: Use the following link: <a class="postlink" href="http://abuse.hetzner.de/statements/?token=30bd25b97cc067efa0ed1a06b449add3" onclick="window.open(this.href);return false;">http://abuse.hetzner.de/statements/?tok ... 06b449add3</a>
- Send a response by email to the complainant

A technician will check the data and coordinate further proceeding. If we have received many complaints the situation can be lead to a server blocking.

Important note:
When you reply to us, please leave the abuse ID [AbuseID:0999C5:23] unchanged in the subject line.


Best Regards,

Sandra Betz

Hetzner Online AG
Stuttgarter Str. 1
91710 Gunzenhausen
Tel: +49 [0] 9831 610061
Fax: +49 [0] 9831 61006-2
abuse@hetzner.de
<a class="postlink" href="http://www.hetzner.de" onclick="window.open(this.href);return false;">www.hetzner.de</a>

Register Court: Registergericht Ansbach, HRB 3204
Management Board: Dipl. Ing. (FH) Martin Hetzner
Chairwoman of the Supervisory Board: Diana Rothhan

----- attachment -----

Return-path: <abuse@clean-mx.de>
Envelope-to: abuse@hetzner.de
Delivery-date: Tue, 18 Dec 2012 22:53:09 +0100
Received: from [62.67.240.20] (helo=relayn.net4sec.com)
by lms.your-server.de with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.74)
(envelope-from <abuse@clean-mx.de>)
id 1Tl564-00023a-UK
for abuse@hetzner.de; Tue, 18 Dec 2012 22:53:09 +0100
Received: from relayn.net4sec.com (localhost [127.0.0.1])
by relayn.net4sec.com (Postfix) with ESMTP id 84702EAC367
for <abuse@hetzner.de>; Tue, 18 Dec 2012 22:52:59 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha1; c=simple; d=clean-mx.de; h=from:to
:subject:cc:mime-version:message-id:date:content-type; s=sel;
bh=xnlCX2Swm/VNi8nTf+jgi/6mlho=; b=Ls1R7JR64y2rhCiVhEwTdKoeblIe
Jnk9Ah1btp0sIImWVh48UUldqzGQvC3eJXoMkX48vn6Iv7cbfCLhQyL0bRNZ9sBR
0d5xDJCVJiYblB7GbbDuJ2JU9rYIaa+dsmyruLgOdh4m5Dhu7rVQJIkeq0iSLdWF
JNn/fOMWiHQQe5M=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=clean-mx.de; h=from:to
:subject:cc:mime-version:message-id:date:content-type; q=dns; s=
sel; b=LQpTy6XJ31J0b7mAkja/K9aqMpzpw41ygdJV+OWjP/q/cp9XBgZra9A5u
F+YMDBlaJSZJKqTHmjylxKTo+rBY8gFWKlbmnDtPTxObIzTZeXErvZF7yFiZH6y9
3tnn6LmB5am8WlVihPRN1RFcX2Pqrmu1Mg+Dsr5lU1yZmnZ9PI=
Received: from dbserv.netpilot.net (unknown [195.214.79.22])
by localhost (Postfix) with ESMTP id 703A0EAC3C2
for <abuse@hetzner.de>; Tue, 18 Dec 2012 21:52:59 +0000 (UTC)
From: abuse@clean-mx.de
to: abuse@hetzner.de
Subject: [clean-mx-viruses-8696894](5.9.39.51)-->(abuse@hetzner.de) viruses sites (1 so far) within your network, please close them! status: As of 2012-12-18 22:51:29 CET
cc: certbund@bsi.bund.de
Precedence: bulk
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-Mailer: clean mx secure mailer
X-Virus-Scanned: by netpilot GmbH at clean-mx.de
Message-Id: <20121218.1355867489@dbserv.netpilot.net>
Date: Tue, 18 Dec 2012 22:51:29 +0100
content-Type: multipart/signed; boundary="----------=_1355867579-18710-48287"; micalg="pgp-sha1"; protocol="application/pgp-signature"
X-Virus-Scanned: Clear (ClamAV 0.97.5/15907/Tue Dec 18 21:38:47 2012)
X-Spam-Score: 0.6 (/)
Delivered-To: he1-abuse@hetzner.de

This is a multi-part message in MIME format.
It has been signed conforming to RFC3156.
Produced by clean-mx transparent crypt gateway.
Version: 2.01.0619 <a class="postlink" href="http://www.clean-mx.de" onclick="window.open(this.href);return false;">http://www.clean-mx.de</a>
You need GPG to check the signature.

------------=_1355867579-18710-48287
Content-type: multipart/mixed; boundary="----=_NextPart"

This is a multi-part message in MIME format.

------=_NextPart
Content-Type: text/plain; charset="iso-8859-1"

Dear abuse team,

please help to close these offending viruses sites(1) so far.

status: As of 2012-12-18 22:51:29 CET
<a class="postlink" href="http://support.clean-mx.de/clean-mx/viruses.php?email=abuse@hetzner.de&response=alive" onclick="window.open(this.href);return false;">http://support.clean-mx.de/clean-mx/vir ... onse=alive</a>

(for full uri, please scroll to the right end ...


We detected many active cases dated back to 2007, so please look at the date column below.
You may also subscribe to our MalwareWatch list <a class="postlink" href="http://lists.clean-mx.com/cgi-bin/mailman/listinfo/viruswatch" onclick="window.open(this.href);return false;">http://lists.clean-mx.com/cgi-bin/mailm ... viruswatch</a>

This information has been generated out of our comprehensive real time database, tracking worldwide viruses URI's

most likely also affected pages for these ip may be found via passive dns
please have a look on these other domains correlated to these ip
example: see <a class="postlink" href="http://www.bfk.de/bfk_dnslogger.html?query=5.9.39.51" onclick="window.open(this.href);return false;">http://www.bfk.de/bfk_dnslogger.html?query=5.9.39.51</a>

If your review this list of offending site, please do this carefully, pay attention for redirects also!
Also, please consider this particular machines may have a root kit installed !
So simply deleting some files or dirs or disabling cgi may not really solve the issue !

Advice: The appearance of a Virus Site on a server means that
someone intruded into the system. The server's owner should
disconnect and not return the system into service until an
audit is performed to ensure no data was lost, that all OS and
internet software is up to date with the latest security fixes,
and that any backdoors and other exploits left by the intruders
are closed. Logs should be preserved and analyzed and, perhaps,
the appropriate law enforcement agencies notified.

DO NOT JUST DELETE THE FILES. IF YOU DO NOT FIX THE SECURITY
PROBLEM, THEY WILL BE BACK!

You may forward my information to law enforcement, CERTs,
other responsible admins, or similar agencies.

+-----------------------------------------------------------------------------------------------

We denote domains and url in this fancy way, because your spamfilter will not pass this !
If you lower your filter drop us a note to reset this attribute for your email contact!


|date |id |virusname |ip |domain |Url|
+-----------------------------------------------------------------------------------------------
|2012-12-17 22:24:08 CET |8696894 |unknown_html |5.9.39.51 |_z_a_r_y_a_d_._c_o_m |_h_t_t_p_:_/_/_w_i_k_i_._z_a_r_y_a_d_._c_o_m_/_d_a_t_a_?_?_?_?_?_?_?_?_?_?_?_?_?_?_?_?_?_?___?_?_?_?_?_?_?_?_?_?_?_?_?_?_?_?
+-----------------------------------------------------------------------------------------------


Your email address has been pulled out of whois concerning this offending network block(s).
If you are not concerned with anti-fraud measurements, please forward this mail to the next responsible desk available...


If you just close(d) these incident(s) please give us a feedback, our automatic walker process may not detect a closed case

explanation of virusnames:
==========================
unknown_html_RFI_php not yet detected by scanners as RFI, but pure php code for injection
unknown_html_RFI_perl not yet detected by scanners as RFI, but pure perl code for injection
unknown_html_RFI_eval not yet detected by scanners as RFI, but suspect javascript obfuscationg evals
unknown_html_RFI not yet detected by scanners as RFI, but trapped by our honeypots as remote-code-injection
unknown_html not yet detected by scanners as RFI, but suspious, may be in rare case false positive
unknown_exe not yet detected by scanners as malware, but high risk!
all other names malwarename detected by scanners
==========================


yours

Gerhard W. Recher
(Gesch�ftsf�hrer)

NETpilot GmbH

Wilhelm-Riehl-Str. 13
D-80687 M�nchen

GSM: ++49 171 4802507

Handelsregister M�nchen: HRB 124497

w3: <a class="postlink" href="http://www.clean-mx.de" onclick="window.open(this.href);return false;">http://www.clean-mx.de</a>
e-Mail: mailto:abuse@clean-mx.de
PGP-KEY: Fingerprint: A4E317B6DC6494DCC9616366A75AB34CDD0CE552 id: 0xDD0CE552
Location: <a class="postlink" href="http://www.clean-mx.de/downloads/abuse-at-clean-mx.de.pub.asc" onclick="window.open(this.href);return false;">http://www.clean-mx.de/downloads/abuse- ... de.pub.asc</a>
------=_NextPart--

------------=_1355867579-18710-48287
Content-Type: application/pgp-signature; name="signature.asc"
Content-Disposition: inline; filename="signature.asc"
Content-Transfer-Encoding: 7bit
Content-Description: Digital Signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJQ0OW7AAoJEBTGcx9kwGtztVgIANAYzdVZYAUzq9mxSIIVkCfm
9MwJGGlfqzOBdeJE1mq7iw2C3gJZAeUM3ifkm6lWCaGviXOijA7YKFKJEOZHggBr
kkhaplsRerjZ7EOBXSX1ecLvCkszAOi9A7rIP/uNMeGXd3TLjrq/GfXCsY4PpOrD
MmTsVvh/hEN/TFk66xX+3iqtccdPsOX4Ai13+4tWqEdJJmW/wR5pApy0oGJtc/z0
46otDnHp3v4OnfQ6OcAD6UBBf0vUuqVZlYQU3fJqPtoybpO9AvZPPF1D7dJDFWqk
2+AepZRJTjrWhOXhuVqB+UVZckI+exlAgEYY5yHck8piXbA/EAHtTDQbRYuhSxA=
=B2AT
-----END PGP SIGNATURE-----

------------=_1355867579-18710-48287--

 

Не слежу за продолжением на хабре, пока не получу ответы на свои вопросы от администрации данного ресурса. Пока сутки молчания, завтра о себе напомню...

А что я намерен делать? Жить и работать дальше. О каких либо ограничениях и речи быть не может. Мы и так все делаем для своих... Многие правда себя таковыми пока не считают, но это не беда, до поры до времени... Значит работаем плохо..