Somebody Uploaded A File Onto My Hosting Account [resolved]

[Spyda 0]

This has really scared me a little. I went into my cpanel to see a file that I did not install, in my File manage. It was called "SubVersion." Pretty confused what it's all about, but I found a link to the site

http://subversion.tigris.org/

I don't know what it is, or how it got there. Can anybody PLEASE help me.

Also, it seemed like somebody messed with one of my folders, and chom'd it to 755, when it was 777. This is really freaking me out a little, I think somebody has gotten ahold of my hosting account.

Edited November 18, 2008 by bk2070 (see edit history)

[truefusion 3]

If a folder has all permissions allowed (i.e. 0777), then this should not be something you should be surprised about. 0777 allows anyone to do whatever they want to that folder, which includes creating their own folders and files. Having it changed back to 0755 was probably a smart thing on their side that is beneficial to you. However, this new file called "SubVersion" should only scare you if it was created outside of the folder that had 0777 permissions and if it can execute something on the server side. Should i assume you got rid of the file?

[shadowx 0]

as a precaution i would check your FTP account settings to ensure that no secondary accounts have been set up (in the event of a breech) and then change all your passwords, FTP and hosting passwords just to be sure. Have you checked the contents of the file to make sure its not malicious? And i too would get rid of that file or at the very least ZIP it so its safe and no-one can access it. That way you have a safe copy to investigate if you need to.

[Spyda 0]

Oh. I think I figured the problem out.Looks like Opaque acccessed my account to see if he could extract .zipped files, since I opened up a support ticket with. Stupid :)As for the incorrectly chomd files, that was a co-admin, I think, trying to install a mod.

[jlhaslip 4]

Topic is resolved.Please PM any moderator to continue this discussion. Until then, this topic is closed.