Urgent - Unauthorized Files

[ckaplan]

I just found 3 files in my images subdirectory on my PowWeb Web space that I didn't put there. (6m.com, 6(1).com and a.com). They are all MS-DOS apps that attempt to run on my C drive. What are those files and how did they get there?

[alphadesk]

ckaplan

Don't have any idea how they got there. Powweb did not put them there for sure. Delete them and change your FTP password/s.

Does anyone else have FTP access?

[ckaplan]

Unbelieveable. Absolutely no one has my FTP Password. This sounds like a security problem at PowWeb. This needs to be reported to your secuity folks ASAP.

[stevel]

If you think there has been a security problem, write support@powweb.com What is the creation date of the files? They probably aren't really DOS applications - that's just what Windows thinks of the .com extension.

[mjp]

Do you have any file upload programs for registered users to use?

If not, the only way any files could get into your account is if they were FTPed in using your username and password.

One scenario is a worm or virus on your system that is trying to propagate those files -- meaning you unwittingly uploaded them yourself (run your virus scanning software or go to http://pcpitstop.com/antivirus/default.asp and do a virus scan), or secondly, someone could have guessed your username/password.

Without getting too specific, your username is easily guessed and you have an insecure password. The username can't be changed but you can and should change your password to something that cannot be guessed or found in a dictionary.

Virtually every "hacking" case we see is not hacking at all, but exploits of FrontPage weaknesses (not as common as they used to be, thankfully) or simple password guessing. The necessity of using a good secure password, containing letters and numbers (and a mixture of upper and lower case if you want to get really tough) cannot be overstated.

mjp

[B&T]

What is the chmod of your images directory? Anyone could put them there if you let them.