I found a file in one of my websites that is suspicious. I cannot find how it was created, I think another script hidden somewhere made it.

Can someone tell me more about a file with this in it?



Thanks in advance!

Looks like the script is being used to view any specified file. One could call it by http://(url)/script.php?sn=(file)

I would look at the file from the shell level to get as much info as possible about it

ls -la /path/filename

ls –la --author /path/filename

ls -l --time=access /path/filename

perhaps look at the access logs to see if there is mention of the file. If the age of the file is recent, then perhaps you might catch where it was first created and then you will have a trace back to the originating IP address. From this you could then lookup who owns the IP address range

whois 12.34.56.78

... and then report this to the data center abuse department.