You are invited to Log in or Register a free Frihost Account!

Accounts from Server 2 being moved to Server 3

Due to Server 2 being compromised and malicious javascript being added to a lot of webpages, I am moving all accounts of Server 2 to Server 3. (This might be temporary and once Server 2 has a new OS and is setup properly, the accounts *might* be put back.)

From now on (actually from half an hour before this post), all modifications to your files and databases on server 2 might be lost depending on when your account is backed up and moved.

You normally don't need to do anything since the nameservers ( and will also be transferred.

Once your account is transferred and restored on Server 3, you will be able to log in to it at . The DNS will only be transferred after all accounts are moved. After that you should be able to access everything like before.

My apologies for all the problems this caused.

If you have any questions, please post them here or in the support forum.

48 blog comments below

I hope server two gets fixed quickly! Good luck Bondings!
Diablosblizz on Mon Oct 27, 2008 8:00 pm
Finally pretty much everything is moved and dns changed. Apart from a few things, it's mostly finished. Please check if your websites are still working fine and you have access to your DirectAdmin.
Bondings on Tue Oct 28, 2008 12:49 am
Thanks mate your a legend for fixing this. Damn the bastards that did it.
smasha on Tue Oct 28, 2008 1:22 am
Thanks for the swift action. Apache seems to be working fine but I cannot login to my webmail - it gives:
Error connecting to IMAP server: localhost.
61 : Connection refused
Connecting through POP3 works fine, however.

I like how you coded a "Reset ownership" button in DirectAdmin. Mr. Green
Arnie on Tue Oct 28, 2008 7:30 am
@Arnie, the "Reset ownership" thing is a new feature of DirectAdmin. I didn't make it.

About squirrelmail, I'll take a look at it during the next few days.
Bondings on Tue Oct 28, 2008 9:09 am
Hey that's great Bondings, thanks so much for doing that!
jylan on Tue Oct 28, 2008 9:23 am
Oh yes, and to add to what Arnie said my frihost IMAP server hasn't been working to send emails either, so I've had to use the gmail IMAP server. Just letting you know, no hurry to get it fixed (for me anyway Very Happy).
jylan on Tue Oct 28, 2008 12:28 pm
@Arnie, the "Reset ownership" thing is a new feature of DirectAdmin
oic, never figured that'd be a useful feature except in a situation like this. Smile

Also interesting to note that there's someone else actually using his email!
Arnie on Tue Oct 28, 2008 5:10 pm
Great work, only one thing: a lot of my pages have <html> <html> appended to them. This creates problems with true XHTML pages. Is this an artefact from removing the malicious scripts? If so, could you maybe fix it? s/<html>\s*<html>// in all files could do no harm I think?
Stubru Freak on Tue Oct 28, 2008 5:13 pm
I hope it will improve the accesebillity of my site, cause I'm also a high demanding hoster. Sorry for that!
atleetalie on Tue Oct 28, 2008 6:48 pm
silverdown on Tue Oct 28, 2008 8:16 pm
It should be the same at the moment. The links you always used should now be pointing to Server 3. Otherwise should also work, but that might only be for a while.
Bondings on Tue Oct 28, 2008 10:39 pm
Great work, only one thing: a lot of my pages have <html> <html> appended to them
Same here, it messes up the HTML Validation.
Arnie on Tue Oct 28, 2008 10:55 pm
I also got <html> <html> in the end of my pages. Why is that? Should we fix this ourself or will there be any global fix?
Peterssidan on Tue Oct 28, 2008 11:12 pm
It took me quite a while to find/make a script to remove the javascript. And since it was pretty urgent to remove it, I didn't spend another few hours to make sure that every html tag was also removed.

I'm not sure if a script to remove the html tag(s) would really be harmless and I really wouldn't like to run such a global script once again. Besides, some of it is added in php and there it's only a single tag.

So it would be the best I think if you would remove it yourself if it bothers you.
Bondings on Wed Oct 29, 2008 12:38 am
Thanks very much for your work, now I have not found any trouble on my site.
the-guide on Wed Oct 29, 2008 5:42 pm
I noticed strange behavior in the site I'm developing, but I don't know if it's related with the change. So, I preffer uploading a fresh copy of the site.

Do you have a date to return accounts to server 2?
iyepes on Wed Oct 29, 2008 6:26 pm
So it would be the best I think if you would remove it yourself if it bothers you.
Well ok, that took me a while for all the HTML and PHP files and I hope I didn't miss one...

But could you look into the Squirrelmail issue?
Arnie on Thu Oct 30, 2008 12:58 am
I am now able to enter Direct Admin and it works but when I visit other pages on my website it errors but the homepage itself does work.

I re-uploaded the page that was having an error and it still errors. I can view the page if I go through FTP though.
Ghost900 on Thu Oct 30, 2008 2:48 am
My Site is giving the following error msg more and more freaquently now Sad.


500 Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Can't log int ot the back end too Sad
Is this because of the server transfer?

It's not permanent; but the error pops up frequently
Rajiev on Thu Oct 30, 2008 6:29 am
Bondings in all reality if you need the extra space and all you can just delete It is doing nothing. I just want to keep my directory listing because it was the first one. Smile
Blaster on Sat Nov 01, 2008 6:08 am
will anything happen to the accounts already on server 3?
leosthenerd on Sat Nov 01, 2008 9:43 pm
Nice fix. Thanks Bondings for all the good things you provide for us.

I was away from the Internet for several days, and I didn't aware of this. That's why I recommend everyone to check the forums daily for critical updates:D

It seems as the file permissions changed, I dunno if its limited to me. But, that's my job.


It's not file permissions but its the ownership. FIXED IT.

FriHost is Home!!
jmlworld on Sun Nov 02, 2008 6:32 pm
Squirrelmail is still not working though Sad
Arnie on Mon Nov 03, 2008 2:58 pm
Backups are not yet moved i think because i missed my backups
tamilparks on Tue Nov 04, 2008 8:09 am
I hope you guys catch whoever caused the problems in the first place. Very Happy
zellfaze on Tue Nov 04, 2008 7:45 pm
so that was the sites downtime a while ago?? now thats terrible, hope it will be fixed soon Shocked
amperx on Wed Nov 05, 2008 3:04 pm
thanks for the caring bondings!!!! Very Happy Very Happy Very Happy

long live to frihost!!!
rebeltrooper on Thu Nov 06, 2008 11:35 pm
my site shows site is reported as attack site. on why this site was blocked on firefox:

What is the current listing status for (edited).com?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 4 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2008-11-12, and the last time suspicious content was found on this site was on 2008-11-12.

Malicious software is hosted on 2 domain(s), including,

2 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including,

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, (edited).com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

* Return to the previous page.
* If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.
friuser on Thu Nov 13, 2008 5:35 pm
Sad to hear it was hacked in the first place Sad
Good luck Bondings!
mariomaster on Fri Nov 14, 2008 5:10 am
It's happening again....!!!!

I had lost all the webpages that i had created and my forum was also deleted...!!! For more details see the following post...!!!

So i was happy that all the accounts were moved from server 2 to server 3...!!! But when i working on my site with the default page given by Frihost on reset of my account i found out that the followng code appeared in the source code....!!!!

<iframe src="" width=1 height=1 style="visibility:hidden;position:absolute"></iframe>

Is it happening again..?? What is happening...?? Bondings help us...!!!
nivinjoy on Wed Nov 19, 2008 3:04 pm
Two days ago, I noticed malicious javascript on my pages, is this javascript kept over when you transfered the files?
coreymanshack on Wed Nov 19, 2008 8:59 pm
I made a google search on the script above then similar results cme...Though i didn't understand the meaning as it is not in english..from the image in the website link given below i understood this scipt is a common problem creator....!!!

See here for more...
nivinjoy on Thu Nov 20, 2008 12:27 pm
lifestyleprod on Fri Nov 21, 2008 11:46 am
Hello Bondings...please comment on this issue....!!!!!
nivinjoy on Fri Nov 21, 2008 12:36 pm
I'm curious if there's a plan to either switch us back to Server 2, or to get Python installed on Server 3.
It's a pain for some scripts I'd like to be able to use...
Star Wars Fanatic on Tue Nov 25, 2008 11:12 pm
please help us same problem exisiting
tamilparks on Fri Nov 28, 2008 5:44 am
how many servers do you have and how often do you have problems??
robertduerden on Mon Dec 01, 2008 12:00 am
Currently there are 3 servers and the issue is said to be happening in Server 2....!!!
nivinjoy on Mon Dec 01, 2008 12:54 pm
So what's the current status ?

The trojan infected websites on server 2.
Bondings removed it.
He shifted sites from server 2 to server 3.

We have to access the DirectAdmin by going to

Is that correct or do we have to change any other settings like CNAME ip address ?
FunDa on Mon Dec 15, 2008 9:32 am
@FunDa and others
Normally you don't need to change anything at all. The domain and its subdomains are all moved to server 3 at the moment.

Only when you pointed a domain/subdomain to the ip address of server 2, then you need to change it to the one of server 3, it is

Most likely you have a domain pointed to server 2 and you really need to point it to server 3 to the ip mentioned above.
Bondings on Tue Dec 23, 2008 7:35 pm
how many servers
Goker on Wed Dec 24, 2008 1:41 am
so what exactly is

the purpose of moving

to another server? Is it

just for fun or is it for a

definite reason, will it

erase accounts?
Johnny_Romance on Mon Dec 29, 2008 6:00 pm
Thanks Bondings.

I do use a separate nameserver (Zoneedit) because I also use Google email and pages
( like and )

So, the IP addresses had been set to server 2 until now ( But everything is working fine. Do I still have to change the IP address to ?

Wait, I'm changing part of it : now without the www is pointed to server 3. WHile is still to server 2. Let me see what happens.
FunDa on Mon Jan 19, 2009 12:16 pm
I'm still a little confused.

Is there any difference between , and ? used to take me to server 2, so I changed the IP address to server 3 and now that too takes me to the same account as above. I still have some backup files to download from server 2, so pls warn me before erasing my server 2 files. Thanks in advance.

EDIT: Well, I have taken my backups. And changed all IP address to (server 3).
But since I use the IP address(i use zoneedit for MX records) and not the frih nameservers, please message me if changing back to server 2 or if there is any change in the IP address.
FunDa on Wed Jan 21, 2009 2:10 pm
any update for server 2 fix?
frenz on Sat Jan 31, 2009 10:49 am
hope it wil be over soone
jesse355 on Tue Jun 30, 2009 8:38 pm
GardenRoses on Tue Nov 17, 2009 7:41 pm

© 2005-2011 Frihost, forums powered by phpBB.