PAYH Domain not working

[#1]

Hi PlusNet
My Domain: http://www.dhea-forum.org.uk is not working why?
I am getting the message:
Server Default page
If you see this page it means:
1. hosting for this domain is not configured
or
2. there's no such domain registered in Plesk
What you can do:
Using Plesk, you can create domains with web hosting on a single physical server.
[Edit]
More info I can ftp to my Domain and add files or remove files, but I can not Brows to my Domain.  This is strange.
[Edit]
Just seen a e-mail of: payh support
With this:
Hi,
We are emailing you to inform you that we have had to temporarily switch
off your hosting for your domain name as a scan on our systems has
flagged up an issue with your site being compromised:
You need to address the situation by ensuring that all 3rd party scripts
that you are using are correct and the latest version (for example an
old version of phpBB is just one example) then switch your hosting back
on via the plesk control panel.
Specific information to assist you as follows:
{CAV}Trojan.JS-36 : ./06/dhea-forum.org.uk/httpdocs/Sources/index.php
{CAV}Trojan.JS-36 : ./06/dhea-forum.org.uk/httpdocs/avatars/index.php
{CAV}Trojan.JS-36 : ./06/dhea-forum.org.uk/httpdocs/Smileys/index.php
{CAV}Trojan.JS-36 :
./06/dyslexia.plushost.co.uk/httpdocs/trust/xoops_lib/index.html
{CAV}PHP.ShellExec : ./06/dyslexia.plushost.co.uk/httpdocs/images/file.php
----------------- End of e-mail ---------------------
I have Replased the index file on:
/dhea-forum.org.uk/httpdocs/Sources/index.php - Replased index.php
/dhea-forum.org.uk/httpdocs/avatars/index.php - Replased index.php
/dhea-forum.org.uk/httpdocs/Smileys/index.php - Replased index.php
I Can not fine veys files:
{CAV}Trojan.JS-36 :
./06/dyslexia.plushost.co.uk/httpdocs/trust/xoops_lib/index.html
{CAV}PHP.ShellExec : ./06/dyslexia.plushost.co.uk/httpdocs/images/file.php
I can not get to the Plesk control panel at:
https://dyslexia.plushost.co.uk:8***
I am getting a 404 Error Page
[Edit]
More info just tried going to: http://dyslexia.plushost.co.uk and got a 404 Error Page, plus I can not ftp to: http://dyslexia.plushost.co.uk
Status: Waiting to retry...
Status: Resolving address of dyslexia.plushost.co.uk
Status: Connection attempt failed with "EAI_NONAME - Neither nodename nor servname provided, or not known".
Error: Could not connect to server
[Edit]
Why is "Pay As You Host" support only available 9:00 am to 5:30 pm Monday to Friday, why aren't calls to "Pay As You Host" handled by PlusNet?
Pay As You Host
Internet House
2 Tenter Street
Sheffield
S1 4BY
PlusNet
Internet House
2 Tenter Street
Sheffield
S1 4BY

[Edit] 12th May 2011 at 07:28:21 by Midnight Caller
My log files are missing today for:  
http://www.dhea-forum.org.uk and http://dyslexia.plushost.co.uk

[Edit]  12th May 2011 at 08:33:58 by Midnight Caller
Looks like todays log files are not going to be e-mailed to me.  
[Edit]
Spelling

[#2]

Hi Gary,
It looks like the hosting platform scan we've started running has picked up on some exploits in your forum software, as I think you've found - and it's been turned off as a result until it's fixed. Unfortunately that means there won't be any logs as the site isn't currently up - you'll start getting those again once it's been re-enabled.
Thanks for replacing those three index files, I think the best bet from here would be to raise a ticket to our support team (http://contactus.plus.net) with details of what you've done and explaining that you can't find the other file mentioned. If you post back here when you've done that I'll pass it through to the guys on the plesk team and they'll get it sorted for you.

[#3]

Ok Ticket number: 42510500
[Edit]
Still can not get to the plesk control panel.

[#4]

Passed it through for you, cheers Gary.

[#5]

Thank you Matt, any idea when I will be able to get to the plesk control panel?

[#6]

Not a clue to be honest. I'd hope it'd be later on today though, depends if they need to do any work or if there's anything they need to ask you to do I guess.

[#7]

Thanks Matt, I have just tried https://www.dhea-forum.org.uk:8*** got to the plesk control panel and logged in, but got the message:

Quote

Error: You do not have permissions to manage this domain

[Edit]
I still get 404 for https://dyslexia.plushost.co.uk:8***
 

[#8]

Hi Gary,
I'm afraid you'll need to wait for the ticket to be updated before anything will change.

[#9]

I have removed "trust" Folder & "images" Folder
/dyslexia.plushost.co.uk/httpdocs/trust/xoops_lib/index.html
/dyslexia.plushost.co.uk/httpdocs/images/file.php
Thank you to:  Matt Taylor & Kev Mawson
All Back up and Running now 

[#10]

Glad it's sorted, cheers for letting us know Please shout up if there's anything else we can do for you.

[#11]

@Matt, any idea how thay injekted the Trojan in to the index files?  the index files were and are Read Only 
It is puzzling how thay did this.

[#12]

I'm not sure, but suspect it happened due to a vulnerability in the version of the forum software you use. That's a guess though. Is it the latest version?

[#13]

Nop it is not the latest version, it is SMF 1.1.8
I can not get it to do a automatic update, and I don't no how to do a manual update.
I need to learn how to do it!  
[Edit]
From automatic update:
Error Message
You cannot download or install new packages because the Packages directory or one of the files in it are not writable!
But I clicked on "All files are writable" and Clicked "Change file permissions"  
[Edit]
I can Delete Packages, but not install Packages.