Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been having issues lately with a certain directory. It seems someone is placing files into it, or something of that sort, and any attempt to delete them is successful, HOWEVER they reappear over time (maybe not the exact same ones, but random files).

I will provide you the information I can and several pictures of my problem:


sandbox.mys4l.com/visual/files/b1.jpg Files like this have been appearing in my /visual/ folder, and I have no clue where they are coming from.

sandbox.mys4l.com/visual/files/b2.jpg This is what is inside on of those weird files, it appears to be nothing problematic.

sandbox.mys4l.com/visual/files/b4.jpg As you can see, in the time it took me to take the first picture, more odd files showed up. These log files are also being uploaded to this directory, and I know I didn't put them there.

sandbox.mys4l.com/visual/files/b7.jpg This inside one of these mysterious .log files, I'm not sure what it's all about.


These files only appear to be going into this specific area, and I'm not sure of their origin, only that they will not go away. I have done a full system scan at least twice with an up-to-date virus scan, and have looked for an unknown script which may be writing them there. Nothing has come up, so I come to you guys as I hear this is the best place to find answers.

Hope this problem has a solution!

share|improve this question
    
@Dustin - what platform? What programs are involved? What languages? –  warren Apr 28 '10 at 17:26
    
@warren -Only problem is that these files are appearing. Not sure what they are from or how to stop them. Not sure if my FTP program is to blame or not, but I'm using CuteFTP 8.0 Professional. As for language and platform, I don't understand what you mean. –  Dustin Apr 28 '10 at 17:28
    
by language and platform, I am referring to what platform is the host that this is occurring on running? Windows, Linux, FreeBSD, etc. What application is running on that host? Do you know what language it is written in? Do you own the server that is running the app? –  warren Apr 28 '10 at 17:36
    
@warren -I'm not sure what platform the server may be running, I believe it is Windows, but I am not sure. I do not own the server, I am renting out the domain through Bravenet(.com). I have looked into the odd files and noticed an even more weird line, it seems they are throwing a copyright with my page link on it. These files seem to be articles... –  Dustin Apr 28 '10 at 17:51

1 Answer 1

up vote 0 down vote accepted

you most probably got your password to ftp stolen, and some bot uploads files that are later used to infect / spam visitors. or those files are referred by other infected pages.

or even worse - you have a backdoor / some guests on your server.

share|improve this answer
    
@pQd -I have deleted my ftp login, and remade it several times using different names and passwords. Do you have any suggestions on how to get rid of this, and prevent it in the future? –  Dustin Apr 28 '10 at 17:55
    
@Dustin - what software do you host there? can it be some popular script that has security holes allowing upload of such files? did you tried to check what http requests were done when files were created? –  pQd Apr 28 '10 at 18:11
    
Sorry my response took so long. I currently do not host any software, I do however allow people to host music that they own, and images. I'm a newbie, so I'm not sure how to do a http request or anything like that. Sorry for my ignorance. –  Dustin Apr 28 '10 at 18:51
    
@Dustin - just ask your hosting provider to send you logs from around time those suspicious files were created. –  pQd Apr 28 '10 at 20:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.