Urgent help

[Divvy]

Hello guys,
Can someone help me?
OVH disabled my server because of a copyright complaint and received this message from them:

--------------------------------------------

Good morning,

We had to act with urgency on your dedicated server ns000000.ovh.net to block an attack. It seems that your dedicated server has a security flaw or a malicious user has gained access.

We were forced to deactivate your server. The magnitude of the failure is such that we most likely carry the complete reinstallation of the server.
We ask you to reply to this message in order to contact one of our directors.

Found below information related to the ongoing process and the open ports on your server when we intervened.

------- BEGIN ABOUT THE ATTACK -------

Pornographic material without disclaimer to prevent children to access such contents and copyright infringement :

My name is Nate Glass, and I am a person authorized to act on behalf of
the owner of an exclusive right that is being infringed.

Authorized DMCA Agent:
Nate Glass
8900 Topanga Canyon Blvd.
Canoga Park, CA
91304
(818) 730-4666
nate@*******************

Proof of Authorization:
http://*******************/auth/evasiveauth.tif

Copyright Holder:
Bubble Butt Inc.
1050 Northfield Ct. Ste 300
Roswell, GA
30076

The following works are the copyrighted property of Bubble
Butt Inc.:
http://www.spicytube.org/movies-engl...epmother-made-
me-2/

A representative list of these works is available at
http://www.evasiveangles.com

Under penalty of perjury:
I have a good-faith belief that use of the material in the manner
complained of is not authorized by the copyright owner, its
agent or the law.

The information in the notification is accurate.

I am authorized to act
on behalf of the owner of an exclusive right that is
allegedly infringed.

This notice is also to inform the allegedly infringing
service provider
that the copyright holder listed above has not licensed, to
the
allegedly infringing website, any works to be used in the
manner
depicted above. Furthermore, copyright holder strongly
encourages
the operators of the allegedly infringing site to not allow
the
continued use of copyright holders works without the
expressed
written consent of the copyright holder. This includes,
but is not
limited to, filtering of content as well as prohibiting the
use of
copyright holders content in an infringing manner.

As per DMCA law section 512(i) to be eligible for Safe
Harbor a
service provider must meet certain requirements. One of
these
requirements is:
"(service provider)...has adopted and reasonably
implemented,
and informs subscribers of the service of, a policy
for the
termination of subscribers of the service who
are repeat infringers"

For this reason, copyright holder strongly
encourages the recipient
of this notice to adopt and implement a repeat
infringer policy.

In order to make the content removal process
easier in the future,
Takedown Piracy suggests that you add the
copyright holder listed
in this notice to a list of Prohibited or
Banned Content on your site
and filter and/or remove any content owned by
this copyright owner.

Please note that all DMCA notices sent by
Takedown Piracy are checked
to ensure compliance by the allegedly
infringing website.
Notices that have not been satisfied will be
escalated to,
including but not limited to, webhost and
upstream provider.
In the event of non-compliance, Takedown Piracy
can and will
confer with the clients legal representatives
and/or specialists in
copyright infringement law.
--
Nate Glass
Authorized DMCA Agent
Email:nate@*******************




------- END ABOUT THE ATTACK
-------

--------------------------------------------

Their replies:

]] Good morning,
]]
In fact ]] have "closed" the server, since it contained copyrighted files and still be related to a porn site (required have a "disclaimer" to notify people who are content to see over 18).
]]
Unfortunately you can not ]] the accommodation of that content, copyrights, on our servers and as such we have locked the server.
]]
You can ask the ]] ticket that will provide access to the SSH server, since for now only have access to the rescue mode FTP, expressly stating that it will fix the problem, removing links and sites listed.
]]
If possible ]] they will provide access to the server to correct the problem, checking and correcting the complaint whichever indicates there.
]]
After corrected ]] position, can then be introduced in HD mode in order to keep the server back online.
]]
Unfortunately here in the ]] support we can not help with these changes, and indeed has to check with management for the unlock.
]]
]] For further questions please contact us.
]]
Thank you for choosing ]] OVH,
]]
Sincerely ]]
]]
Ricardo ]]
OVH Portugal ]]

Good morning,

The SSH access you will be given to you to correct the problem before putting the server in HD mode.

Yes, I'm talking about the ticket incident. At this point should have been released and sent him the access codes by SSH.

At this point you can then correct the situation and can only ask the server to pass the HD after having corrected the situation, although it has to do just and only for ssh.

For further questions please contact us.

Thank you for choosing OVH,
Do not forget to visit our forum (http://forum.ovh.pt) and if you want to leave a message.

graciously

Ricardo
OVH Portugal

And now I received this email:

Your mode server restarted 'Rescue', which means that the
Linux / BSD is released on the server through the network. It is not
system that is usually installed on your server, no
of the partitions is mounted.

A web interface is available to allow you to make a
diagnosis of your server (hard disk, raid, ram, CPU) and
traverse the entire tree of your file system:
http://xx.xxx.xxx.xxx:xx
- User name: xxx
- Password: xxx

You can connect via SSH to your server (xx.xxx.xxx.xxx)
with the following parameters:
- User: xxx
Password: xxx

You can now perform the maintenance required
the restoration of your server, for example, you can:
- Check and update their files, network configuration,
- Check and eventually disable its firewall,
- Check and update your LILO (or configure other boot
through the network: http://guias.ovh.pt/KernelNetboot/
- Conduct manual scan of your system files,
- Make a backup or restore data,
- Etc.


If you think you have identified the source of the problem and want to reboot
your server should normally set the netbooted its
on the server hard disk or on the OVH kernel:
http://guias.ovh.pt/KernelNetboot/ reboot and do the "SOFT"
your server (to avoid reboot through manager - reboot HARD).


You will find further information in our guide:
http://guias.ovh.pt/ModeRescue/

Sincerely,
OVH Customer Support

Can someone please teach me how to delete a wordpress post via SSH?
I need to delete the wordpress post to solve this issue, but they cant put my server online until I solve this... They said to solve only via SSH.

Waiting for your help. Thank you!

Regards,
Divvy

Divvy Reviewed by Divvy on 5th Mar 2012. Urgent help Hello guys, Can someone help me? OVH disabled my server because of a copyright complaint and received this message from them: -------------------------------------------- Rating: 5

[accyuklad]

should of stayed away from ovh lol

you could try connect by winscp it shows files etc

[msk19994]

Nate Glass is a bitch he deletes stuff all the time and btw never use ovh on warez site they kill when they get a dmca

[Divvy]

Is possible to delete a wordpress post via SSH?

[vgnheart]

mount your disk while on rescue mode. Chroot then take a copy of sql db as backup. Also take copy of wp php files. Then tell them you want to re-install OS.
Once re install is completed restore site and immediately remove the post.

Its better if you move site from ovh

[Divvy]

Thank you for your reply vgnheart.

I want to move my site from ovh, but I need to solve this situation first right?
Or I can move the site now and delete the account via SSH?
And tell them that is solved...!?

---------- Post added 6th Mar 2012 at 10:05 AM ---------- Previous post was 5th Mar 2012 at 08:44 PM ----------

I tried following command to suspend the account which have copyrighted materiel.
/scripts/suspendacct <accountname>

But didn't worked in rescue mode:
http://screensnapr.com/v/pVgfhp.png

Any suggestions please?

[Gavo]

This site is using a hacked database of W junction

[vps9Ryan]

Mount the drive to e.g. /mnt/hd

then chroot /mnt/hd

and then you will be able to work your way.

Cheers,
Ryan

[vgnheart]

check the directories mountmd1 ------ mountsd3. one of them will carry the /home an sql folders of your centos install.
chroot to that mount

[HotNiche]

i use OVH but for "legal" websites...
on your other thread you were advised to choose other providers mate