site really slow

[Crothian]

This has been really slow all week. And with the constant on and off of slowness ever since the crash I was wondering if this was just something we need to get used to or is it ever going to go away?

 

[BOZ]

it's pretty bad at the moment...

 

[Jdvn1]

It was really slow yesterday, too.

 

[Pinotage]

This has been really slow all week. And with the constant on and off of slowness ever since the crash I was wondering if this was just something we need to get used to or is it ever going to go away?

It's only you, Crothian. It's an subversive attempt to undermine your post count!

Pinotage

 

[Piratecat]

Pinotage, shhhh!

We're aware of it. We've cleaned out logs and tackled the problem, and we're better - but maybe still not where we should be. Some of it is ENnies traffic, but not all of it.

 

[Twin Rose]

The folks down at the server are working on it now, I don't know all the details but they'll have it fixed soon. It's actually SLOWER than it was while they are working on - which at least we know they're doing something.

By the way, for the time being there won't be any emails going out from EN World - this should be corrected soon. They're deactivated as the mail host is what's causing the problems

 

[Mark CMG]

What are the "folks down at the server" telling you this time?

 

[Morrus]

Same problem - there's an exploitable script which is sending out thousands of emails from "Chase Manhattan" every hour. We're being used to send spam, basically.

We thought it was due to a hole in CM's chat script, so we killed that but the problem continued. We've now closed down some other things, hoping we've got it.

 

[Twin Rose]

Same problem - there's an exploitable script which is sending out thousands of emails from "Chase Manhattan" every hour. We're being used to send spam, basically.

We thought it was due to a hole in CM's chat script, so we killed that but the problem continued. We've now closed down some other things, hoping we've got it.

That appears to have been the original insertion point. We're trying to track down the script itself now and get rid of it. We've locked down the folders that the script tries to use to create PHP files that send out the spam, so it won't happen again as long as we're diligent. Once the scripts are purged we should be okay.

 

[IronWolf]

The Apache log files would most likely help you track down exactly what script is being used to do this eliminating most of the guess work.