3 byte files problem

[griffonn]

Hello,

 

My problem is very strange:

Starting from about before two weeks I found in root folder of my osCommerce installation thousands of files without any extension, named with long strange names like 50308e55e64632487706a6ea3f256688 (pay attention that it uses only numbers and letters a..f, like HTML color codes, but the number of digits is not "compatible" with colors), containing one different number - it could be 0 as far as 2.5 or something else. These files are created sometimes every hour or two, sometimes many of them at the same minute.

There were about 300 such files, I deleted them manually, and after two-three days I fould over 8000 of them!

What are these files, how can I find the place in the code that creates them?

 

Thank you in advance,

Gregory.

[♥geoffreywalton]

First thing I would do is check the patches to secure your admin directory have been installed. (Link to Jan's posting is in my profile).

 

Then I would install all the suggested add-ons in the How to Secure my site thread by Spooks, once again link is in my profile.

 

Check the date time the files are created and look in your logs to see who is accessing your site at these times. You can also check your ftp logs.

 

HTH

 

G