The server I'm on is using Plesk and in the httpdocs directory there is a folder called test which has a structure similiar to the following:
httpdocs/test/cgi/ httpdocs/test/coldfusion/ httpdocs/test/fcgi/ httpodcs/test/php/
Specifically within the fcgi directory, there are 4 files
fcgi.py fcgi.pyc test.fcgi test.html
I am a programmer, not a server administrator. All of the files in this seem like they are created by default via the Plesk control panel as they all have the same timestamp ( Last modified ). There is one file however that was added to the directory at about 2 am with a 'last modified' date about 1 month after the others, which is fcgi.pyc. I've downloaded it and opened in VI and it is full of characters such as:
although there is some html thrown into the file as well.
We've had issues before with finding variants of c99shell and other websites on the same server being allowed to run functions like exec() and get lists of files on the domain. I am just wondering if anyone familiar with Plesk/Servers would know why a seemingly corrupt file names fcgi.py appears in this directory.
I've searched google for the filename and all I find is open directories that are containing the same file.
If anyone can provide any insight whatsoever I would be quite grateful.