I really like this upload package and want to use it, but from the time I set it up on my server, I've been hacked twice by something called the AnonGhost virus (anonghost.com). I tracked the malicious files back into the jQuery-File-Upload-9.5.6 folder, which I downloaded from my hosting server back to my local directory for examination. I had renamed this folder to 'upload' before putting it up on my server originally, for an easier path, and when I tried renaming the folder in my local directory so as to make a copy for examination, the entire folder made a copy of itself and renamed itself back to "upload". It was protecting itself. Inside the main folder, in the server/php/files folder (where images are stored on upload) were files not originally there, one named log.php, another named massdeface.php, both containing malicious code.
I'd like to know if this problem is recognized by anyone, and what I might do to protect myself from it recurring. I'm thinking the solution might involve creating and/or editing an Nginx file to restrict file types, but that's a bit over my head. A walk-through would help.
Many thanks for this.