tribulatio
User
Jan 7, 2012, 9:00 AM
Post #1 of 4
(6540 views)
Shortcut
|
|
AM 1 advice about suspicious files in the publish folder
|
Can't Post
|
|
For a website that is not updated frequently, I continue to use... AM 1.2. And it works flawlessly, there are only a few hundreds of articles, a few more every year - so I do not see any need to change.
But anyway, the purpose of this post is not to advertise past versions of AM! I have come across something suspicious, and before attempting to delete the items, I would like to have expert opinion.
I do publish all the articles in one folder, called /p. Yesterday, as I was testing a cloud backup service for that website and other ones (myRepono.com, a quite interesting tool at affordable price), I noticed that it could not backup two files that are found in that folder. The names of those files are:
include.php
report.php
There is also a third file called: index.php
I attach a screen capture showing how they look in cPanel.
It is impossible to open include.php and report.php, impossible also to download them in order to analyze their content locally. And the backup system cannopt back them up.
The website was hacked a year ago (not first time), and I suspect those are legacy files from that hacking. This suspicion is reinforced by the content of index.php, the only one I am able to open. It reads:
"<!-- Placeholder file for previously hacked file that contained string HackeD By [hacker's name] -->
Lines of code follow.
Before attempting to remove those three files, or asking the webhost to remove them if it is impossible for me to erase them, I just want to be sure: there is no way AM 1.2 could produce in the publish folder such php files, correct?
Thank you for confirming that! The files must have been there for quite a long time, and I prefer to ask before erasing them.
|
Capture d’écran 2012-01-07 à 17.46.04.png
