wp-includes/Text/Diff/.log files with misleading names

  • Hello,

    In a subdir on the server (wp-includes/Text/Diff/.log) i find a map with about 3500 html-files with misleading names. For i can see these files have nothing to do with my site. Therefor i’m afraid that some malicious stuff has find his way on my site.
    What can i do now? How to clean up my site from unwanted content or how can i scan my site en clean it up?
    The date’s of these files are going back to 1 october 2013.

    Thanks in advance.
    With regards,
    Oipjuss

Viewing 2 replies - 1 through 2 (of 2 total)

  • Hi Oipjuss,

    you can start e.g. here: https://sitecheck.sucuri.net/

    And yes, having such folder and files inside of that particular folder is really suspicious. My guess is some kind of spam infection but without more details, I’m unfortunately not able to say more.

    You can also check this link where you can get more useful information:

    https://codex.www.ads-software.com/FAQ_My_site_was_hacked

    If none of these helps, just try to give us more detailed description, e.g. what’s your site address, are there any other problems or suspicious behavior on your site? What WP version do you use? Etc.. Generally, the more details you provide, the better the community will be able to help.

    Thread Starter Oipjuss

    (@oipjuss)

    Hi Peter,

    Thanks for youre reaction.
    Sucuri scan ended with no infections.
    I deleted that folder en i checked the folder permissions.
    The next day the same folder was there again.
    I use the plugin “WP Security Audit Log”. I see no strange actions logged.
    Also i use the plugin “Wordfence Security”, also with no result. These misleading html-files still are generated.
    I have WP 3.9.1
    The site runs normaly but i’m worried about content that comes from somewere. I’m not waiting for some disgusting pages.

    Thanks again.
    With regards,
    Oipjuss

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘wp-includes/Text/Diff/.log files with misleading names’ is closed to new replies.