Disable PlugIn for Direct Admin

[countryboy01]

All,

I am sorry that this a noob question, and that it may have already been answered(If so I was unsuccessful at finding said article as I've been searching for weeks on this).

I work for a Domain Hosting Only Company. Pretty much if it is a server based issue, or mail client, I assist.. If the issue is with a hole/leak in an end user website, we cannot assist and they need to contact their web designer.

Well we have a client that has had their website taken over and sending emails out on their behalf.

The end result is that I need to find a way to disable the plugin(s) to stop this sending. I have just taken over this system and the person before was not familiar with even the basics of how this system works.

Here is the detailed information(Please note as a confidentiality notice I have changed some information to ensure the privacy of our system and end user, the information listed below domain wise will be fake, were as the actual path of the infection is real).

/home/a2/domains/a2.com/public_html/plugin/content

When I use ls I get the following:
--cssgallery, --finder, --geshi, --joomla, --jw_simpleImageGallery,
--pagebreak, --vote, --emailcloak, --footer.php, --index.html, --jw_allvideos,
--loadmodule, --pagenavigation

Also the Plugin that was installed via Installatron is "My Portal".

I do have full root access to the system as well, and the website owners, and web designer are on vacation for the holidays, I have already nofiitied them about the issue so they are aware of all this.

If someone could advise on how I can disable the "plugin/content" location that would be helpful.

Thank you in advanced.

 

[nobaloney]

You can temporarily disable any app (that's the name I use for them) by renaming their directory so they can't be found, or else, if they've been compromised and will send out stuff even if it's in a different directory, you can chmod the directory to 000.

The problem with the chmod is that it may make it impossible to backup the site or remove it, so I'd do it only as a last resort.

Jeff

 

[countryboy01]

You can temporarily disable any app (that's the name I use for them) by renaming their directory so they can't be found, or else, if they've been compromised and will send out stuff even if it's in a different directory, you can chmod the directory to 000.

The problem with the chmod is that it may make it impossible to backup the site or remove it, so I'd do it only as a last resort.

Jeff

Jeff,

Thank you for that. To be honest, I have thought of that, but my main concern is that once the issue is corrected, if I change the path to what it originally was, would that restore the website as a hole?

Like if I changed the path /plugin/content to something like "/plugin/content_html/" and once the end user fixes the issue, and the path is changed back to the basic /plugin/content, would everything work as it did before website wise(not the corrupted stuff).

Thank you for your response as well.

 

[nobaloney]

You're welcome .

No one can tell you if disabling the app will cause problems with the site except the site developer, because no one except the developer knows how integrated into the site it is.

But does that really matter to you? If the app will cause problems for your server and/or other users, do you really care more about the client's site integrity than the ability of the rest of yur clients to use your server? (For example, if an app is sending spam and you don't stop it you will find yourself on blacklists and your clients unable to send email.)

If you don't want to risk damaging your client's site integrity by disabling his app, then just contact him and hope he can clean it up before it causes you and your other clients any problems.

Jeff