J1.0.13 site getting attacked at will - Joomla! Forum - community, help and support

hi friends,
my website(joomla 1.0.13)  getting attacked @ , brought down , bought guy , has added me im inform me , make life hell.i thought shared hosting godaddy since happening since last couple of days , bought vps hosting , installed new j1.0.13 new database imported users old database , he's attacking new installation again @ , letting me know.he says he's attacking servers , when attacks site become inaccessible , think if restart webserver site starts appearing again.

when did today,i reported webhosting guys attack time , came reply:

code: select all

we verified logs , found there repeated attempts access server.
----------
oct 5 03:40:48 blog sshd(pam_unix)[9854]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.xxx.xxx.xxx user=root
oct 5 03:40:52 blog sshd(pam_unix)[9903]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.xxx.xxx.xxx user=root
oct 5 03:40:55 blog sshd(pam_unix)[9965]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.xxx.xxx.xxx user=root
oct 5 03:40:59 blog sshd(pam_unix)[10016]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.xxx.xxx.xxx user=root
-------------

please note furhter support subscription chargeable.

we suggest conduct security audit in server. kindly authorize charge of 99.5 euro conduct same our end.


i noticed these entries in access log think has attack:

code: select all

[color=red][edit] russw : ip address removed[/color] - - [03/oct/2007:02:39:17 +0300] "get /index.php?[color=red][edit] russw : exploit text removed[/color]
.....
.....
[color=red][edit] russw : ip address removed[/color] - - [04/oct/2007:06:56:47 +0300] "get /index.php?[color=red][edit] russw : exploit text removed[/color] http/1.1" 200 167 "-" "libwww-perl/5.805"
.....
.....



i not want mention site name in public it's vulnerable rite now.i can send in in pm.guys,please me , there can do??? if pay webhosting guys,do think resolve issues??

one hint guy giving was saying add "$log#" database....i dont know that.

please help.
thanks

[edit] russw : removed references sites , ip addresses

check have joomla! rg_emulation off in site control panel , php register_globals off, check extension revisions against vulnerable extensions list, check not have directories or files mode of 777.

please review following faq's asap, find wealth of information related issues.

  security & performance faq

it not recommended leave sites publicly available , exploited, serve promote offenders ego , kudos , potentially expose rest of server attack.

the above mentioned faq provide more enough information assist in further securing sites.

particular entries of note , pay attention to, are;

  joomla! administrator's security checklist

  help! site's been compromised. what?

  vulnerable extension list

  joomla! tools suite
  how can check joomla! installation's overall security , health?

  what joomla! have file permissions?