My cache seems to have been going smoothly for weeks, but then this week, i'm starting to see files i don't recognize in my cache. i've deleted them twice and even called my ISP to make sure i have not been hacked.

can you tell me what is happening? where these files are coming from?

file names:
_FID=0.html
_T=reg.html
_mod=logging&action=login.html
_option=com_registration&task=register.html
_action=registernew.html
_action=login.html

i've changed all of my passwords, host control panel, FTP, mySQL db, drupal admin passwords etc, but it happened again after all this.

are these files standard cache files or is something wrong here?

thanks for any help, Jean

Comments

Anonymous’s picture

Anonymous (not verified) commented

Looks like normal boost files possibly from a probe so you should check your log files for GET and login.html on the same line which will give you the ip of the machine or machine that is probing.

Boost (if configured correctly) disables when forms are posted, and the pattern above suggests that a bot (most likely) or an individual (not that likely) is sniffing around your server using GET requests. If there are multiple ip addresses then you've probably gone onto a list for a botnet, this does not mean there is anything to worry about unless your installation of drupal is up to date (and there are no zero day exploits around). There are thousands of probes a day on the net so it's not that much to be concerned about though I would check the contents of the pages with a javascript disabled browser and/ or text editor, and if there's any redirection in there like to a paypal fraud site then I'd be concerned but wouldn't delete them I'd turn off boost, put a .htaccess deny from all file in and contact your isp as the file modification and ownership information could be important (e.g. if the ftp server was hacked then the information on the files provides a starting point for when files were uploaded/ modified or if you are on shared hosting then someone else on the same machine may have been hacked and placed the files in your domain).

If the worst has happened then deleting the files and crossing your fingers isn't going to help find backdoors etc... but you are probably okay.

Philip.

jmatuska’s picture

jmatuska commented

thanks for the speedy reply.
in checking my logs i DO find a get and a login.php over and over and over coming from just one IP address.
do i block that IP in my drupal admin interface? or do i need to block that IP at my host?
thanks again for your advice!
jean

Anonymous’s picture

Anonymous (not verified) commented

Block it at your host, the probes may include services other than just the web server.