File type changed to php.suspected?

lahmar amine

• September 12, 2018 17:53

Since last 4 days, we are facing strange issue on our Production server (AWS EC2 instance) specific to only one site which is SugarCRM. Issue is /home/site_folder/public_html/include/MassUpdate.php file is renamed automatically to /home/site_folder/public_html/include/MassUpdate.php.suspected This happens 2-3 times in a day with 3-4 hours of gap. This issue occurs only in case of specific site, even it doesn't occur for staging replica of the same site. I even checked code of that file from both sites, it's same. We have Googled and found, such issue occurs mostly for Wordpress sites and it could be because of attack. But we checked our server against the attack, there isn't any. Also there is no virus/malware scan running on server. What should we do?

• 

  rpvw

  • September 13, 2018 06:57

  A thread with the exact same question exists on Stack Overflow -

  0
• 

  cPanelMichael

  • September 13, 2018 18:49

  Hello @lahmar amine, The information in the previous post is solid. Let us know if you have any additional questions. Thank you.

  0

Please sign in to leave a comment.