6

I was going through page hit logs on awstats and I noticed the following two entries:

/deleteme.lcivykmt.php
/deleteme.nctqicjg.php

I was wondering if anyone recognised them and whether I should investigate.

I suppose it's nothing to be concerned about because they are listed as page not found errors by my cms but does anyone know what software this would be targetted at?

5 Answers 5

6

These appear on my Wordpress installation every time the cPanel Installatron script runs to autoupdate. They come from the cPanel Installatron script. If you installed Wordpress via a cPanel script and set it to autoupdate Wordpress Installatron will produce these files.

They are safe to delete.

2
  • What's in them? Do they pose any security risk if they are not deleted?
    – MrWhite
    Commented Nov 6, 2018 at 16:23
  • You can edit your answer to include any additional information / code samples.
    – MrWhite
    Commented Nov 12, 2018 at 12:38
3

Those files look like installation files for something like Wordpress, Joomla or Drupal etc. and if left on the system will doubt be a way in for hackers. The 'evil bots' are randomly checking for these kind of files (left over from incomplete installations) in order to find vulnerable sites. Although the 'lcivykmt' part of the filename should be a random string of characters so I would have thought this should be very hard to guess?!

1
  • Ja, I was thinking either remnant of install files from a cms or possibly some malware that is used to compromise sites (once some write access to the directory structure is gained)
    – jcuenod
    Commented Sep 8, 2011 at 16:54
3

deleteme.???.php is an Installatron temporary script. It should be self-deleting, so the fact that it remains means that the script crashed mid-task. This might have been during the original installation of the application, during a backup, or during an update.

If you have notifications enabled you should receive an email when one of these tasks fails.

And these files should be deleted if you spot them in your account (unless their date stamp is like right "now", of course). The same with old scripts named itron.php.

1
  • Using a naming convention like that is quite common and not limited to Installatron
    – Steve
    Commented Jun 28, 2017 at 11:00
0

That's probably a bot testing your site's security. Ban those IPs:

iptables -A INPUT -s <IP> -j DROP

Note: if you reboot, the iptables rules are lost, be sure to use a persistency system.

0

Probably these files would open some attack vector and that's why some evil bots are looking for them on servers they scan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.