Web Hosting Talk : Web Hosting Main Forums : VPS Hosting : Quickweb.co.nz service suspension

[TheBronx]

I'm a client of quickweb since 25 Mar 2011, I have a VPS and an additional CPU core.
In more than 1 year just one serious problem with their German datacenter, almost one day offline, but they solved the issue and we didn't loose any data.
Their support is fast, and good, so I have a good opinion of them.
Until now.


What happened? Well, these are the facts:
Got an email from quickweb this morning, at 10:55am:

Service Suspension Notification
Suspension Reason: Trojan complaint

Please contact us as soon as possible to get your service reactivated or if suspension was due to overdue payment simply pay the outstanding invoice to get your service automatically reactivated. Your service along with your data will be removed from our server within 24-48 hours if payment is still not received with no possibility of recovery.

Cheers,

Your Friends At QuickWeb

Read the email at 11:37, and opened a ticket. As my site is a board, I suppose someone uploaded a bad file and our team didn't found it, so, here is the ticket:

Subject: suspension
Status: open
Urgency: High
Related Service: VPS Hosting

link please...

11:45, Matt S. from Quikcweb, answers:

Hello,

Can you please explain your issue little bit clear so that we can assist you further regarding this.

Thanks!

Kind regards

Yeah, my ticket was a bit short, but you will understand it later, so, I answer, 11:49:

Suspension Reason: Trojan complaint

Thats all I know.
So, where is the trojan? Probably a link like:
http://board.mywebsitelink.com/downl...php?id=XXXXXXX

It is a board, people can upload files so it is probably a bad user that uploaded a bad file.

Let me know the ID or the link and I will delete the file.

11:58, Joe Selly from QuickWeb answers with the full email that was sent to them, and of course, the link:

IP: 80.83.XXX.XXX
URL: http://board.mywebsitelink.com/download/file.php?id=621
Port: 80
Tested on: Fri, 01 Jun 2012 10:19:38 +0200
Result: Trojan.Generic.6295948

Well, everything as expected, but, server still offline, so I can't do anything hehe, 12:00

Thanks but I can't delete anything if the server is offline...

And now, the problem. 12:06

too many complaints about your server, you need to take a vacation for at least 2 days.

Kind Regards,

Joe Selly

"Too many complaints". You must think I'm a virus lover or something like that, well, the facts:
Complaints about malware during my year and 3 months with them:
-> 08/11/2011 Malware found, service suspended. Opened a ticket and got the answer:

We received the virus notification below (relevant data extracted), regarding a website on your server XXXXXXXX. viruses sites (1 so far) within your network, please close them!

Please investigate the issue as fast as possible. We need your urgent feedback and information about all steps taken to stop further abuse. Please find the original notification below.

Please reply within the next 24 hours and leave the subject of this email unchanged for referencing.

|date 2011-11-06 21:00:21 CET
|id 1072468
|virusname TR/VBKrypt.brc
|ip 80.83.XXX.XXX
|domain website.com
|Url http://website.com/download/file.php?id=1313


Kind Regards,

Joe Selly

Once they let me enter the server, the file was not there. My team deleted it before the suspension. So, problem solved.

-> 31/05/2012 Yep, 2 days ago. I opened a ticket with the following content:

malware.
where, I have a forum, hundreds of users upload files every day. Where is the malware? I will delete it now.

Their answer:

Date: Fri, 25 May 2012 08:17:18 +0200
Source: 80.83.XXX.XXX
Source-Type: ipv4
Download-Link: http://website.com/download/file.php?id9
Antivirus-Result: [UG]
Attachment: none
Category: abuse
Report-Type: malware-attack

As the first time, they let me enter the server to find and delete the virus. But, seems the attachment was an image. Yeah, and thats not all, the image was uploaded in 2009, and was uploaded by me. Yes, was a small image I took myself, and the file was not modified since 2009. But, as I didn't care about the old image, I deleted it, and deleted also the other 2 images uploaded that day by me (were not reported as virus, but who cares). And I also said that in the ticket.

And thats all. Two complaints about malware. One came too late, and the second was 100% sure a false positive (as it was detected as "obfuscated" and not as a specific virus).


too many complaints about your server, you need to take a vacation for at least 2 days

That's what QuickWeb considers "too many".

I've tried to dialogate with them, with the same reasons I'm posting here. But... my ticket was "escalated" and I'm still waiting for a response. Service still suspended after 6 hours.


I'm not happy with their support, and I don't think it is fair. That's why I'm posting this thread.

Thank you and sorry for my english.

[KMyers]

Hello,
I understand that this is just one complaint, but can I ask if it was your first complaint or are they fairly common? a 2 day suspension is harsh if this is the first report you have ever seen however very understandable if you get a lot of complaints.

You may be able to appeal the 2 day suspension if you do the following;

1) Advise that you will remove the offending file (which you have already done)
2) Advise that you will take further actions to prevent additional abuse complaints such as
-Implementing a virus scan system to automatically scan the server and remove infected files
-Adding MIMI Type restrictions to all uploaded files
-Terminating the account of the user who uploaded the virus and blocking the IP address from new registrations.

[TheBronx]

I've colored in blue all the complaints I've had during my 15 months with quickweb.
As you can see, only 2 complaints, one was solved before they suspended the service (our team was super fast, the virus was deleted in just a few hours), and the second one was a false positive.

We always ban users uploading bad files, we have an antivirus in the server scanning everything, they already know that. I can't do more, really.

About MIME Types, I think we already have that, cause it is a phpbb3 board.

Thanks for your help KMyers. I will update as soon as I have more information.

[KMyers]

Originally Posted by TheBronx

I've colored in blue all the complaints I've had during my 15 months with quickweb.
As you can see, only 2 complaints, one was solved before they suspended the service (our team was super fast, the virus was deleted in just a few hours), and the second one was a false positive.

We always ban users uploading bad files, we have an antivirus in the server scanning everything, they already know that. I can't do more, really.

About MIME Types, I think we already have that, cause it is a phpbb3 board.

Thanks for your help KMyers. I will update as soon as I have more information.

Can I ask what MIME Types you are allowing?

[TheBronx]

5 hours since the ticket was escalated. Still waiting for an answer.

PS: answered KMyers via private message

[QuickWeb-Roel]

Give me your ticket i'll have look, we do not tolerate sites spreading viruses

[TheBronx]

Thank you Roel.
tid=692659

My site is not spreading viruses. We have a specific group of people just for virus scanning. We do not tolerate viruses, and we ban people uploading suspicious files.

1 year and 3 months, 2 complaints about malware (I should say 0, not 2 as explained in the first post, blue color), this is the third.
In fact I should complain about the first time, because you suspended the service when the file was already deleted. Or the second time, a false positive.
But I didn't say anything, we all can make a mistake, and a few minutes of downtime are not very important.

I really don't think this is fair.

[TheBronx]

And now, 11 hours since their last answer (ticket escalation) they accuse me of violating private and confidential terms, as tickets may contain confidential or privileged information.

As you can see, I didn't post any email direction, url, IP or any kind of sensible information.

And of course they don't answer to my complaints. I won't say a word about this attitude, yet.

I hope Roel can change this situation, I have a good opinion of him, I am only having trouble with one of their support members.

[QuickWeb-Roel]

we received tons of complaints about your server, what was provided was just one of them, hop on the ticket and let's resolved it there and we will explain all your violations.

[TheBronx]

Thank you Roel, hope we can solve this as soon as possible. Ticket bumped.

[gilbert]

Quickweb usually has good servers and network normally. But they are based in Malaysia and that is the only time when they are really able to work on your stuff.

I have been putting a lot of my sites behind cloudflare lately to prevent some of these bad people from uploading stuff.

I also recommend trying to get terminal / console access at least so you can get to your vps.

If I were you I would have complained on here as well mosts hosting companies that advertise on web hosting talk dont like negative stuff on here about them and this makes them a little more prompt.

PS Make sure your websites scripts are all up to date as well. There are so many updates to keep up with and it can be frustrating. But there are always new bots trying to scan your website for exploit to embed. And I often scan my website for malware through this tool... http://sitecheck.sucuri.net/scanner/

[QuickWeb-Roel]

But they are based in Malaysi

we are not based in Malaysia, we are New Zealand based, our tech support is 24x7 unless it is ticket about sales, admin then it will be dealt with during admin hours normally until 10PM NZT (it is not uncommon we have Admin staff until 12mn) and not 5PM unlike host other companies... dealing with account suspension due to abuse is admin matter.

If I were you I would have complained on here as well mosts hosting companies that advertise on web hosting talk dont like negative stuff on here about them and this makes them a little more prompt.

This normally don't work on us and can put you in more trouble

[jarland]

Originally Posted by QuickWeb-Roel

we are not based in Malaysia, we are New Zealand based, our tech support is 24x7 unless it is ticket about sales, admin then it will be dealt with during admin hours normally until 10PM NZT (it is not uncommon we have Admin staff until 12mn) and not 5PM unlike host other companies... dealing with account suspension due to abuse is admin matter.



This normally don't work on us and can put you in more trouble

So you're saying you punish customers for bad reviews?

Just kidding

Thanks for sharing your experience with us TheBronx. Sounds like it has been handled appropriately, but I can understand your frustration.

[QuickWeb-Roel]

Originally Posted by jarland

So you're saying you punish customers for bad reviews?

Just kidding

Thanks for sharing your experience with us TheBronx. Sounds like it has been handled appropriately, but I can understand your frustration.

well it depends whether poster is intentionally trolling then it will be ignored or be subjected any applicable TOS violations.

But this particular one is admin matter hence some delay during hours admins are off work, we are now working for this client to stop his site from spreading the virus as our upstream ordered us to stop the abuse so we are complying too.

It has been suspended before and we restored service upon agreement client will fix the issue but it is still re-occurring hence it must be stopped until fully resolved otherwise we risk the whole server get unplugged.

[TheBronx]

Seems thinks are being solved. I shouldn't have posted their names, and it seems there are more than just one or two suspicious files in the server (don't know yet).
I apologize for my attitude.

They are letting me enter the server to fix the problems (in a few hours, I can't do it now).

I would like to thank Roel for his help, and Joe for being so patient with me. He didn't want to cause any damage also, he was just sleeping (or whatever he does at night xD [it's a joke]).

I will update as soon as I finally solve the issue, and clean Quickweb and his support reputation.

Thanks