Found some weird files on my server - Am I hacked? - Webmaster General forum at WebmasterWorld

Just found 2 files I didn't create, but I suppose it's possible Wordpress did?

File 1: "Y3VzdG9tcGhwaW5mby5waHA=.php"
Contains:

<?php $envVar = array("GATEWAY_INTERFACE","HTTP_ACCEPT","HTTP_ACCEPT_ENCODING","HTTP_ACCEPT_LANGUAGE","HTTP_CACHE_CONTROL",
"HTTP_CONNECTION","HTTP_HOST","HTTP_USER_AGENT","PATH","REMOTE_ADDR","SERVER_ADDR","SERVER_ADMIN",
SERVER_NAME","SERVER_PORT","SERVER_PROTOCOL","SERVER_SOFTWARE" );
echo "<html><body style=\"background:transparent\"><table width=\"100%\">";
for ($i = 0; $i < count($envVar); $i++){
echo "<tr style=\"color:#555555;font-family:Arial,Helvetica,sans-serif;font-size:10px;\" onmouseout=\"this.style.backgroundColor='transparent'\";
onmouseover=\"this.style.backgroundColor='#f6f6f6';\">";
echo "<td>" . $envVar[$i] . "</td>" . "<td>" . $_SERVER[$envVar[$i]] . "</tr>";
echo "</tr>";}
echo "</table></body></html>";?>

File 2: "cGhwaW5mby5waHA=.php"
Contains:

<?php phpinfo(); ?>

Are these legitimate or should I delete them? Would it be safe to delete these?

They are both in the root folder of my site, and were created about a month ago. Nothing has happened to my site, but should this info be publicly viewable?

If people view the files, (e.g. going to mysite.com/Y3VzdG9tcGhwaW5mby5waHA=.php) they can see the info that php outputs.

[edited by: phranque at 10:02 pm (utc) on Apr 23, 2010]
[edit reason] fixed sidescroll [/edit]

Found some weird files on my server - Am I hacked?

anon123

coopster

anon123

coopster

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week