Topic: Saratoga Based Cumulus Site Server Files

[griffo42]

On my web server I have 183 files taking up 1061k of resources.  Files details of each are in the form of:

kstwx.net_9999999999.php 5940bytes on dates which are not following a daily pattern.

What are these files for?  Are they necessary for the efficient running of my website?  Can I delete them? Can the be stopped from being added to my server?

The URL for my site is https://kstwx.net/index.php

best wishes

Keith

[hcorrin]

Have you looked at the contents of the file may be a log of some sort

[saratogaWX]

Please .zip up a couple of those files and post them here .. I'll take a look.

None of the scripts included with the Saratoga templates use a naming convention of 'kstwx.net_9999999999.php' so there's likely some other non-Saratoga script doing that. 

[saratogaWX]

I also sent a PM with additional things to do...

[griffo42]

Hi Ken

Attched, as requested in your reply #2 timed 07:42:06, are ZIP files of the last 2 files which have appeared on my server.

best wishes
Keith

Ed. note.  I deleted the two attachments.  They are malware.  Please see my PM to you about further actions.. we need to disinfect your website.

[saratogaWX]

Go ahead and delete all the kstwx.net_*.php files on your site.. they're all malware.

We'll continue the debugging conversation via PMs.