Cant log on to my hosted site

[#1]

A ticket has been raised for NetOps team but I have had no reply as yet Question (230064858)  This issue seemed to manifest its self without any intervention taking place the first I knew of it was clients looking at site were being confronted  by an error.

I have gone into control panel and tried to get in to manage databases and have been confronted by the following

MySQL said: 

Cannot connect: invalid settings.

 mysqli::real_connect(): (HY000/1045): Access denied for user 'ccgiangust735453'@'91.136.11.218' (using password: YES)

 phpMyAdmin tried to connect to the MySQL server, and the server rejected the connection. You should check the host, username and password in your configuration and make sure that they correspond to the information given by the administrator of the MySQL server.

I get the same on both databases one for each site as I have said had not been doing any webspace work any clues or help from team would be great

[#2]

Hey there @Gazztee I hope you are well. I can see you have contacted us over the phone today. Is there anything you need me to look at?

[#3]

Hi Wil yes I think the whole case has been misunderstood what I would like is access to my database and alll files to migrate them elsewhere.  I have checked with the IT guy Who sorted out domain name with another company but the fact remains force9 still hosts site I have checked this today I have witnessed our files through your site and problem it is having but nobody seems to connect with our needs

Moderators Note: Attachment including personal information removed but still visible to Plusnet staff.

[#4]

@Gazztee - I can take a look and see if there's anytihng I can do to help. Any objection to me resetting/changing your MySQL passwords?

Edit: no need, I think I spot the problem. Leave it with me...

[#5]

I have no problem at all with that anything that may resolve this situation thanks

[#6]

@Gazztee - I've clocked off for the day but nudge me next week so I don't forget and I'll check where we're at with things. The priviledges for your SQL user accounts looked wonky when I last looked. I've raised it with the hosting vendor.

[#7]

In my exploring the possibilities I felt the database was causing issue although I am not aware of changes being made that may cause issue.

[#8]

@Gazztee - I've taken another look at this and now I'm not so sure.

I've taken the liberty to enable PHP errors on your site and now when trying to visit it, it seems clear from the errors being returned that it's looking for files that are no longer where Wordpress expects them to be (you can disable error logging if you wish by deleting or renaming the .htaccess file I've placed in your root) 

There are some suspicious 'quarantine...' directories in the root of your site that contain copies of these files. Did you create these? If not, I've a suspicion that your site got compromised and our hosting vendor may have taken action as a result.

Those directories are dated from the first week of December. Might this coincide with when the site broke?

[#9]

I did not create them and I have the only legit pathway into edoting site,I did see these files there and they are very close to the time that the site went down I was not sure if this was a normal feature to have I am new to this level of investigation as I have said previously the site was not being worked on by ourselves in fact it had been recorded as working as normal it was only a user who reported site was not operational

[#10]

Have looked at these files and they do represent what should be in wordpress end of site.  Why would they go into quarentine and if there was intervention by an outside party wht no contact.

[#11]

I can't explain the lack of notifcation, however if you were running an old/insecure version of Wordpress or any of it's associated themes/plugins then it's not outside of the realms of possibility that the site became infected. When this happens it can allow a remote actor to upload bad things to your webspace that can then be used for things like phishing activity etc. 

If there was a risk to others, then our hosting provider will reserve the right to take whatever activity is necessary to put a stop to the errant activity.

Leave it with me and I'll see if the permissions/site content can be restored. Once this is done though, you will need to ensure all of your PHP installs are up to date and patched against any known vulnerabilities etc. Might also be wise to change the login credentials for your databases/reconfigure your scripts etc. once done too.

[#12]

@Gazztee - I've made contact with our hosting partner, and whilst they're struggling to find an explicit record of the action that was taken on your site, it seems pretty clear to me that this is what has happened. They have suggested you try moving the files back to their original locations and then work on bringing things up to date.

I don't really want to fiddle with things on your behalf, so feel free to give it a go and let me know how you get on. I can't help but feel the permissions for some of the files may have been changed but proof will be in the pudding.

[#13]

Is there a point of reference to where the files should be located, I presume that will be the files under quarentine?

[#14]

Do you have a Wordpress back up which you can restore?

[#15]

@Gazztee - from what I remember, one quarantined folder is empty. The other contains sub directories that match the location under /public where the containing files should be restored to.
e.g. if there's a 'wp-config' directory in quarantine, then its contents should go in /public/wp-config/
If you're really not comfortable attempting it, then I can give it a go myself but I'll only do so with your permission.