Thousands Of large files appeared on my site...

Discussion in 'Security' started by mistermix, Feb 26, 2009.

  1. #1
    I received an email today from my host saying my server was almost full. Usually my sites only use less than 5% of the disk space, so I knew something was up.

    After looking into things I noticed that one of my sites home directory is full of over 2000 7-8MB files, all created today.

    Here's an example of the files:

    [​IMG]

    The site is a php/mysql based site and has stopped loading properly too.

    Can anyone help?
     
    mistermix, Feb 26, 2009 IP
  2. emigre

    emigre Peon

    Messages:
    516
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Ask your web host to check those files - they're the best people to get help from.
     
    emigre, Mar 2, 2009 IP
  3. ThreeGuineaWatch

    ThreeGuineaWatch Well-Known Member

    Messages:
    1,489
    Likes Received:
    69
    Best Answers:
    0
    Trophy Points:
    140
    #3
    They are probably not the system dumping core. Too small. Might be made to look like that. Is the site running a third party script? If so, it might have a hole in it and need updating. As emigre said, talk to your host as soon as possible.
     
    ThreeGuineaWatch, Mar 2, 2009 IP
  4. Thibaut

    Thibaut Well-Known Member

    Messages:
    886
    Likes Received:
    26
    Best Answers:
    0
    Trophy Points:
    140
    #4
    Antivirus can do that as well.

    Regards
    Thibaut
     
    Thibaut, Mar 2, 2009 IP
  5. zacharooni

    zacharooni Well-Known Member

    Messages:
    346
    Likes Received:
    20
    Best Answers:
    4
    Trophy Points:
    120
    #5
    zacharooni, Mar 3, 2009 IP
  6. mistermix

    mistermix Active Member

    Messages:
    2,326
    Likes Received:
    85
    Best Answers:
    0
    Trophy Points:
    90
    #6
    Thanks for the help.

    My host said is was "php crashing". A crash was caused by an error_log file hitting the 2GB mark.
     
    mistermix, Mar 13, 2009 IP
  7. Ladadadada

    Ladadadada Peon

    Messages:
    382
    Likes Received:
    36
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Good work by your host figuring that out.

    We had a similar problem once with one of our sites but because we had PHP core dumps going to /dev/null we didn't have any idea that it was going on. The only clue was that somewhere in between 11pm and midnight the site stopped working and at midnight it started working again. (We only knew this from the tracking statistics. None of us ever saw the site not working.)

    It turned out that the access logs were hitting 2GB by around 11pm each night and then were being rotated and a new log started at midnight. Then, the previous day's logs were compressed so we never saw a folder full of precisely 2GB files (which would have been a good clue about what was happening). It wasn't until I decompressed a bunch of log files to look at the times when the site broke that I realised they were all exactly 2GB.
     
    Ladadadada, Mar 14, 2009 IP