So as per the title, my hosting account with Host Department was recently hacked in to and infected a few of my web sites. No word on who it was or how they did it, but they infected over 400 files, and dumped over 3000 files on the server. I'm just interested in finding out what exactly was left on my server.. I've looked at a few files and they are actually super interesting. I was just wondering if any one could lend a hand in identifying what the files are for...? I've compiled all of the files in a directory on one of my sites. There's also a zipped file in the root Directory if you'd like to download them to examine the PHP code. Before going to the link, please read below: Please note that although I see no warnings and haven't incurred any viruses when browsing the files both on the web and on my local hard drive, there's always a risk when viewing possibly malicious files. There's over 3000 (Like 6 PHP files, and the rest HTML files). Browse and download these files at your own risk! http://pages.deziine.net/hacked/ Can any of you figure out what the heck these files are, and what they're for?
If it is shared, I would contact the hosting company to see how exactly the person was able to gain access to your site. Find out if your Control Panel or FTP password was compromised, or if there is a security whole in the programming on your site. If the person got in some what not relating to you, the hosting company should know about it. I don't think a person can dump that many files into your web space without evidence of it being in log files - whether your site specific log files or the server log files.
i'm not looking at how they got it, im just wondering what the files are... i mean like they aren't malicious, they are just htm files... why would someone dump HTM files... it seems pretty pointless to me.
For backlinks? Dump a whole bunch of HTML files onto a server, Google indexes them gives a whole bunch of websites a whole bunch of backlinks. Jen
Do you run some free PHP scripts like CMS, blog or forum? If yes, make sure that you have upgraded to the latest version. Using old versions may be security risk.