filezilla ftp virus detected and removed

The file is easily viewable once you download it and open it in a local editor.

One thing to note about hxyn.php is that is that it contains some mechanism to keep you from viewing it on the Web server using nano or vi (at least I couldn’t view it on this particular server, which is Debian based). Again, I’m not a coder, but from what I can tell this file is designed to check for vulnerabilities or security flaws on the web server (.htpasswd, config files, admin files, etc). This file was the “Web Shell by oRB” script. The last change was that a file named hxyn.php was uploaded to the root of the Web site. They are both shown in this pastie: #1851393 - Pastie They didn’t look right so I removed them. There were two other things in that same file that I think were probably additions, but I can’t know for sure since I didn’t have the original to compare against. Then, within a seven day window, one other file was modified and one was added.įirst, an index.html file in a sub-directory was modified to include this script: #1851387 - Pastie (NOTE: Your anti-virus may go crazy viewing that link if you’re worried about it then you can view a screenshot of it here: ImageShack® - Online Photo and Video Hosting.) They contained compressed binary code, as outlined in other posts. I am not sure if that is normal for this server or if it was modified during the attack.įiles 43.php and 95.php were added. The file was also hidden so it did not show up when I was looking at the file modification dates. htaccess file was modified (thanks to Sventy’s post for cluing me into looking for that). One day later, two more modifications were made:

The first modification to the site was the addition of '' at the bottom of the /index.php page. If any of what I say seems basic then forgive me I hope what I found might add to the discussion. Note: I’m not a coder or Web designer, I’m a Cisco guy. The stuff I found was in line with what others found, but there were a couple of additions as well. She asked me to clean it up for her so this week I took a look at it.

I wasn’t looking for anything malicious, but it stood out so I started digging into it, and ultimately found this thread. A couple of weeks ago I came across this line of code on my girlfriend’s Mom’s Web site:

Filezilla ftp virus detected and removed