Issues with Dreamhost redirecting malicious sites with PHP Trojan

Posted by Dan Israel on Mar 3, 2012 in Information & Technology

Web-hosts are like dogs and fleas.  Just varying combinations of personality, sizes, and quirky issues.  And I’m certainly not naive enough to believe the grass is actually greener … to take my metaphorical web-dog over to.But the events of of the last week have finally caused me to apply energy into the task of leaving Dreamhost!   So long.  Here’s why…Dreamhost records were hacked recently.  And according to their founder/president, Shell user/passwords were exposed.  I KNOW!  Whether or not that breach in their security led to the most recent one…I can’t answer.  And frankly, don’t care.  Downtime was common with them for my sites.  But this time, when the sites began redirecting unsuspecting subscribers to porn and spam sites…support did not respond.  By the end of the second day, the sites were completely failing.  Still no response from them.  Here is ultimately what we found after we got the data off their servers.PHP infectedAt some point malicious code was used to place a some Trojan code at the head of ever PHP file on the server (eval 64 code ).  It seemed to be fairly benign code that randomly redirected browsers.  But being in the front of EVERY .PHP file was enough to bring a WordPress installation to its knees.  It not only infected core files, but plug-in files as well.  It was, literally, everywhere.DreamhostI used to think I got what I paid for with Dreamhost.  But after moving the sites to Danica’s place, my disdain for Dreamhost is increasing.  This is mostly due to seeing  the new host perform without several issues that had long plague one of my sites while on DreamHost.  Issues that Dreamhost Tech Support had been telling me for two years was poorly written WordPress code – yet code that seems to run flawlessly quick on the new host (some would say, like a race car)!GoDaddyIt’s too early to really be convinced their new 4G platform is a web-hosting panacea.  I’ve had a bit of an issue with the FTP process.  Part of this was due to an outage GoDaddy had for about 6 hours.  But I believe part of it is the latency from server clustering.  But the certainly seems to be a benefit from page server performance.MORE TO COME….