Help! Suspended again?

[SteveN]

it looks like my account/site have been suspended again!!! Last week, I was informed that I was using too much server space in violation of the Acceptable Use Policy (I'd used an area of our space for a backup of all my projects and important files -- over 11G

After being informed of this (and getting re-activated), I deleted all the offending files, but this afternoon, it looks like I've been suspended again

Can someone at WHB tell me what's happened? Didn't I get the files removed?

Steve

[Alan B]

I suggest that you submit a ticket at https://www.whbsupport.com/

[SteveN]

Well, in the time it took to post that Message, I heard from WHB with a report of excessive CPU usage by my site The report looks like (with my account/site obscured):

03-10-2009
xxxxxx xxxxxxcom 7.87 0.31 0.0
Top Process %CPU 99.7 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe
Top Process %CPU 96.8 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe
Top Process %CPU 91.1 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe

03-09-2009

xxxxxx xxxxxx.com 11.39 0.58 0.0
Top Process %CPU 106 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe
Top Process %CPU 97.8 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe
Top Process %CPU 93.0 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe

03-08-2009

xxxxxx xxxxxx.com 8.93 0.37 0.0
Top Process %CPU 108 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe
Top Process %CPU 105 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe
Top Process %CPU 102 /usr/local/frontpage/version5.0/exes/_vti_bin/shtml.exe

As you can see, there is an exe called shtml.exe that's eating up LOTS of CPU time...trouble is, I can't find that file anywhere in the files I load up for my site! I'm guessing that they are part of the FrontPage Extensions.

Any comments?

[Alan B]

It does appear to be part of the Frontpage executables. I can't offer specifics, as I do not use Frontpage, but I do recall that many version of Frontpage had poorly-written extensions. They could cause instability or load issues.

Do you really need Frontpage extensions?

[SteveN]

Well, my website was built using FrontPage, so I'm assuming that I need the extensions.

I know that I need to get the site updated, but it hasn't been a high priority (until now)

[Alan B]

Well, my website was built using FrontPage, so I'm assuming that I need the extensions.

Eye rolling aside, the second does not follow from the first. Frontpage extensions are used for specific functionality such as form submissions. If you have a static site of html pages, you may not need the extentions at all. If they are being used, you may be able to find non-Frontpage substitutes for them, such as well-written CGI or PHP scripts.

[Tony]

Are all these files updated?
From: http://www.iss.net/security_center/r...e-name-dos.htm

FrontPage 2000 Server Extensions is vulnerable to a remote denial of service attack. By requesting a URL using the shtml.exe component of FrontPage 2000 Server Extensions, an attacker can overflow a buffer...

[Alan B]

Yikes! Yet another of the many reasons to avoid FrontPage.

[Veronique]

Do accounts get suspended here often?

[Helen K.]

Hi, Veronique. It's a pleasure to see you here. Welcome to our team!
What about suspencions, we are suspending accounts only if they violate our AUP and abuse the server resources or due to nonpayment. It won't happen if the site is fitting quota and the requirements of its package. And suspencion isn't terminating , we can unsuspend one's account just as suspended it, the only thing we need is a customer's confirmation, that the issue will be resolved.We are suspending accounts not to punish our customers, we are suspending accounts in order to lessen the load on the server, caused by some account, so that other customers don't feel inconveniences due to possible bad performance. Sometimes we need to suspend some abusive accounts, it's inevitable, but it doesn't happen often.

[Matt R.]

Actual figures are around 10 suspensions a day. If you compare this to the number of sites we host (which is into 6 figures including resold accounts), it's a pretty ratio.

[SteveN]

Matt R & LenaK
Well, I've been down for about 16 hours now, with no replies from WHB since 5:39pm yesterday! I've sent numerous emails to Igor P., and this morning sent a fax...I've looked up the support phone# and am about to call that too! Any suggestions on how to get my account re-activated?

Reading the link supplied by Tony sure sounds like my situation...my site was written using only FrontPage with no other scripts or programs added, so I can't imagine that it's my site that's causing the excessive CPU usage.

One thing that I've noticed (and reported) in the past was that I was getting a lot of 'administrator' emails regarding undeliverable emails. But, these emails were not originated by me, and from what I could see of them, they look like spam! Could someone have hacked/hi-jacked my account and use it for spamming? If so, how could I stop this???

It's been 15 hours now, and I'm waiting for my clients to start calling me asking what's wrong with our web-site

[Alan B]

Could someone have hacked/hi-jacked my account and use it for spamming? If so, how could I stop this???

Yes, that is possible. I suggest you change all your passwords. It's also possible that the FrontPage insecurity was exploited by someone. I suggest that you get rid of the FrontPage extensions. Find an alternative to them. If you tell us why you needed them, we can suggest safer alternatives.

[SteveN]

The only reason I need them (I'm assuming) is that my site was built with Front Page 2003. I know that I should be using a more modern authoring tool (DreamWeaver?), but as the site was working, and wasn't broke ("If it ain't broke--don't fix it"), I hadn't done anything.

If FPE isn't necessary for a site built with Front Page, then definately remove it!!!!!

In the next couple of months, I hope to find time to re-write in something like DreamWeaver. In the mean time, if I need FPE for a FrontPage derived site (with nothing 'special' that I know of being used), what alternatives do I have? Remember, I'm a C programmer, but NOT a Web programmer--I originally used FrontPage because it worked with a minimum of work on my side.

Thanks for your suggestions and help...

ps. Until I get my account re-instated, I can't change password or FPE, so there's nothing that I can do is there????

[Alan B]

The only reason I need them (I'm assuming) is that my site was built with Front Page 2003.

As I already said, that does not necessarily follow from the first. FrontPage extensions are used for specific functionality such as form submissions. If you have a static site of html pages, you may not need the extentions at all. You can build lots of sites with FrontPage that do nor require FrontPage extensions.

You should know what the site needs. You built it. You need to understand how it works, as you are responsible for what it does on the server. There's a quick way to test: copy the site to an area of your PC's drive that does not have the extensions. If the site works, then you likely don't need the extensions. I can't be more specific, because you haven't given us any details about why you might need the extensions or what is on your site.

Until I get my account re-instated, I can't change password or FPE, so there's nothing that I can do is there????

Once you are temporarily reinstated, I suggest that you immediately delete the site. You can replace it once you know you have something secure. Then try the site locally, as I suggested, and learn whether you need those extensions or not. If you do, find alternatives.

[SteveN]

I've been re-instated (after a Chat)!!!

First thing I did was to change PW.

Next, I'll follow your advice and take the site down and test it locally. Again, I just used FrontPage to build the site, and I have no 'forms' or anything else the might need FPE that I know of (does the hit counter need it???). So, after testing, and if I don't need the FPE, I'm guessing (hoping) that I can just FTP the site back up.

I've got my fingers crossed.

Thanks again for your help.

[Alan B]

Your hit counter might use FrontPage extensions. If so, get rid of it. Those things aren't accurate anyway. You're better to rely on AWStats that you'll find in cPanel.

[SteveN]

Thanks again for your suggestions.

I've changed the Password and remove the FPE as soon as I got access to my account again.

I've tried my site (as-is) on my local drive, and it appears to work just fine (except that the hit counter doesn't -- no big surprise), so I'm FTP'ing it back to my site now.

As soon as it's up and running again, I'll go in and actually remove the page counter from the site.

Then, with the site at least back up, I'll focus on moving on to DreamWeaver (or something else??? I'm open to suggestions).

Thanks again,
Steve

[Alan B]

I don't use Dreamweaver or any WYSIWYG tool. I hand code. I use NoteTab, which is pre-configured to insert HTML elements with a single click. So while I technically hand code, I don't have to type, for example, <H2></H2> or {position: absolute;}, because I just click button/menus that insert HTML elements, CSS propertiesand other markup.

Hand coding, using a smart tool, allows you to learn more about how your site is built and about what is possible.

If you want a WYSIWYG tool, there are plenty available. If you have only a single site and update it only occasionally, you should be abe to do everything with a hand-coder even if your skills are limited. If you do a little more and want WYSIWYG, there are still lots of choices that cost much less than Dreamweaver.

[SteveN]

Thanks for the suggestions.

FYI, I've removed the FPE and FTP'd my site back up, and everything (except the Hit Counter) seems to be working

Now, without shtml.exe there, WHB should be happy and I've got some time to plan on my update strategy.