I really like this upload package and want to use it, but from the time I set it up on my server, I've been hacked twice by something called the AnonGhost virus (anonghost.com). I tracked the malicious files back into the jQuery-File-Upload-9.5.6 folder, which I downloaded from my hosting server back to my local directory for examination. I had renamed this folder to 'upload' before putting it up on my server originally, for an easier path, and when I tried renaming the folder in my local directory so as to make a copy for examination, the entire folder made a copy of itself and renamed itself back to "upload". It was protecting itself. Inside the main folder, in the server/php/files folder (where images are stored on upload) were files not originally there, one named log.php, another named massdeface.php, both containing malicious code.

I'd like to know if this problem is recognized by anyone, and what I might do to protect myself from it recurring. I'm thinking the solution might involve creating and/or editing an Nginx file to restrict file types, but that's a bit over my head. A walk-through would help.

Many thanks for this.


closed as off-topic by Gilles, TildalWave, Steve, Jens Erat, Xander Dec 26 '14 at 16:20

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – TildalWave, Steve, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Have you already read the security wiki page? Because it allows to upload all file types by default, including PHP files. – Gumbo Mar 9 '14 at 14:10

Browse other questions tagged or ask your own question.