problem with .mx files generated as copies of all .php files

[Demitry 38]

hi,

I'm trying to figure out why I keep getting a ton of these .mx files inserted as copies of all the .php files on the sub-domain I am working on. The files look like this:

.mx.99063925.mx

though with different numbers for each file,.. and when you open one of these files, its content is identical to one of the .php files I have in the same directory. These .mx files are not generated for any other extension except for .php and each of the .mx file sizes matches the same .php file. They are basically clones of all the .php files.

I cleaned them out of every folder and a day later they all reappeared. That happened three times now. This file type is commonly associated with email files, but these are not email files and have nothing to do with that. They are also not desktop files as detailed in this article.

https://www.reviversoft.com/file-extensions/mx

I called my hosting company several times and they have no idea of what it is. The only thing I was told, was that their higher tier tech support came across this problem once before with a WordPress site and after running a shell script to clean all the .mx files, the issue never came back. They are now trying to figure it out and doing a full site scan.

I thought it might be a hack, but this is unlikely. I've done a number of scans for viruses & malware and they all came back clean. I have nothing in my error log and no noticeable issue browsing the site. There is also nothing in the console via Chrome Developer Tools. The .mx files just add clutter to the directory structure and nearly double the size of the osC software.

I searched everywhere on this issue (including osC forums) and could not find anything of value. I'm just wondering if anyone has come across this issue before and how it was resolved?

Here is an image of FileZilla showing these .mx files.

[Demitry 38]

Update:

I was given a shell script by my hosting company to clean all of these files out at once, which is a huge help because I had to do it manually the past few times. However, I have not cleared all of these files out just yet. I want to give the hosting company techs plenty of time to figure this problem out before removing it from the server.

Here is the script in case someone else runs across this same issue.

find /home/change_to_your_own_directory/public_html/ -type f -name "*.mx" -exec rm -rf {} \;

Please be very careful before using anything like this, and back-up entire site and all files (along with the .mx file) before running this script. If you don't know what you're doing, don't mess with it!

 

[♥ecartz 354]

You could reduce (but not eliminate) the danger by removing the r from rm -rf

find change_to_your_own_directory/ -type f -name '*.mx' -exec rm -f {} \; 

The r stands for recursive and is what allows rm to delete directories.  Without it, rm will only delete files. Better might be to do something like

find change_to_your_own_directory/ -type f -name '*.mx' -print
find change_to_your_own_directory/ -type f -name '*.mx' -delete

Where you check the files printed by the first line before running the second line. 

Two possibilities that come to mind: 

1.  This is caused by some IDE.  E.g. Dreamweaver MX.

2.  This is a hack attempt of some sort. 

Similar problem reported at https://stackoverflow.com/questions/61875526/mx-files-found-in-wordpress-core-files-with-the-same-core-code -- perhaps that will get a relevant answer. 

[Demitry 38]

@ecartz

Matt, ..you're awesome!!

I don't know shell scripting ..so this will not only help me, but anyone else who comes across this thread.

I have not removed these files just yet. I'm still waiting to see if my hosting company comes up with an answer before cleaning that entire sub-domain.

I did see that stackoverflow.com post when searching for an answer but there were no solutions offered on that post.

And though I still use Dreamweaver (old habits die hard), this is the first time I've experienced this problem. And you might be right on point with this outdated software. Tough to let go of that comfort pillow. lol

Thanks Matt.

[domiosc 21]

In my casa is point 2.: created similar files .1489c721.ico and edit index.php or create random php file to link this file, I delete, but recreate so a security bug exist need to fix

[Demitry 38]

Quote

In my casa is point 2.: created similar files .1489c721.ico and edit index.php or create random php file to link this file, I delete, but recreate so a security bug exist need to fix

hi Vicent,

My hosting company made a back-up of that subdomain and then ran a shell script to remove all those .mx files. So, I really did not have to do anything. Since that time, there has not been any more incidents of this weird file replication.

I called my hosting company to try and get some idea of what it was. They said, they thought it was a hack. However, I am not convinced because all scans came up empty and I did a folder comparison to a prior back-up and there was nothing new or different. My hosting company tech support also said this problem was currently occurring with other accounts, non-osC accounts.

So, for now, all is good. Hope you find what is causing the .ico file replication. It might be a related issue. Use the shell script from this thread to remove all those files from the server, though be sure to back-up first.