Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 2 down vote favorite

I was going through page hit logs on awstats and I noticed the following two entries:

/deleteme.lcivykmt.php
/deleteme.nctqicjg.php

I was wondering if anyone recognised them and whether I should investigate.

I suppose it's nothing to be concerned about because they are listed as page not found errors by my cms but does anyone know what software this would be targetted at?

share|improve this question

migrated from stackoverflow.com Sep 8 '11 at 11:47

3 Answers

up vote 1 down vote accepted

Those files look like installation files for something like Wordpress, Joomla or Drupal etc. and if left on the system will doubt be a way in for hackers. The 'evil bots' are randomly checking for these kind of files (left over from incomplete installations) in order to find vulnerable sites. Although the 'lcivykmt' part of the filename should be a random string of characters so I would have thought this should be very hard to guess?!

share|improve this answer
Ja, I was thinking either remnant of install files from a cms or possibly some malware that is used to compromise sites (once some write access to the directory structure is gained) – j3frea Sep 8 '11 at 16:54
up vote 0 down vote

That's probably a bot testing your site's security. Ban those IPs:

iptables -A INPUT -s <IP> -j DROP

Note: if you reboot, the iptables rules are lost, be sure to use a persistency system.

share|improve this answer
up vote 0 down vote

Probably these files would open some attack vector and that's why some evil bots are looking for them on servers they scan.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.