XF 2.2 weird folders in JS directory

[CrispinP]

folks,

I have some weird folders in the js directory.

ls shows tihis:


contents of all have 3 files in. Always two js files and one empty html file. Names of the two js files always differ with one of them seemily random.








I found this because an rsync job I have to back up complained that one of the folders had vanished. I thought the name looked odd so too a look and found this.
All in all, there are 2298 folders in my js director! What gives?????

 

[Mr. Jinx]

Looks like your server has been compromised or someone found a way to write files.
IS this host fully patched with the latest security updates?
Did you use any suspicious add-ons?

 

[CrispinP]

I had a duff upgrade in 2022 and needed to restore from backup hence all the files being created on the same day - 5th of March 2022.
It's also why they're owned by plesk

Unfortaunately, I only keep monthly backups for 9 months and my oldest backup is from May 2022 so I cannot look back further than that.

Considering a lot of these are js fils with a hint to "advert" it must be something weird with adverts......

How they (blah) did they get onto my server and why did rsync see one and then complain it vanished....?

 

[CrispinP]

Looks like your server has been compromised or someone found a way to write files.
IS this host fully patched with the latest security updates?
Did you use any suspicious add-ons?

Yes, fully patched OS and religiously do so every week or two. Always have. Maybe the occasional month gap.
Xenforo - yes, always keep that up to date too within a week or two of them releasing an update.

Annoying thing is, considering my previous post, I have no idea when this could have happened....

 

[CrispinP]

another thing re compromise - I have a couple of honeypot accounts in there which are also monitored by haveibeenpwned. Not the most advanced way but a canary of sorts. Nothing flagged.

 

[CrispinP]

I remember what it is -

It's the Adblock detector I have installed.

[Wutime] AdBlock Detection [anti-AdBlock]​

I was scratching the back of my brain because I knew I had this issue before. I guess my backup/restore process brought in files the addon did not know about and thereor did not delete.


No compromise