Jump to content
Sign in to follow this  
Demitry

problem with .mx files generated as copies of all .php files

Recommended Posts

hi,

I'm trying to figure out why I keep getting a ton of these .mx files inserted as copies of all the .php files on the sub-domain I am working on. The files look like this:

.mx.99063925.mx

though with different numbers for each file,.. and when you open one of these files, its content is identical to one of the .php files I have in the same directory. These .mx files are not generated for any other extension except for .php and each of the .mx file sizes matches the same .php file. They are basically clones of all the .php files.

I cleaned them out of every folder and a day later they all reappeared. That happened three times now. This file type is commonly associated with email files, but these are not email files and have nothing to do with that. They are also not desktop files as detailed in this article.

https://www.reviversoft.com/file-extensions/mx

I called my hosting company several times and they have no idea of what it is. The only thing I was told, was that their higher tier tech support came across this problem once before with a WordPress site and after running a shell script to clean all the .mx files, the issue never came back. They are now trying to figure it out and doing a full site scan.

I thought it might be a hack, but this is unlikely. I've done a number of scans for viruses & malware and they all came back clean. I have nothing in my error log and no noticeable issue browsing the site. There is also nothing in the console via Chrome Developer Tools. The .mx files just add clutter to the directory structure and nearly double the size of the osC software.

I searched everywhere on this issue (including osC forums) and could not find anything of value. I'm just wondering if anyone has come across this issue before and how it was resolved?

Here is an image of FileZilla showing these .mx files.

mx-files-on-server.thumb.png.df44783d471f09782445c6391e70a4a2.png


osCommerce: made for programmers, ...because store owners do not want to be programmers.

https://trends.google.com/trends/explore?date=all&geo=US&q=oscommerce

Share this post


Link to post
Share on other sites

Update:

I was given a shell script by my hosting company to clean all of these files out at once, which is a huge help because I had to do it manually the past few times. However, I have not cleared all of these files out just yet. I want to give the hosting company techs plenty of time to figure this problem out before removing it from the server.

Here is the script in case someone else runs across this same issue.

find /home/change_to_your_own_directory/public_html/ -type f -name "*.mx" -exec rm -rf {} \;

Please be very careful before using anything like this, and back-up entire site and all files (along with the .mx file) before running this script. If you don't know what you're doing, don't mess with it!

 


osCommerce: made for programmers, ...because store owners do not want to be programmers.

https://trends.google.com/trends/explore?date=all&geo=US&q=oscommerce

Share this post


Link to post
Share on other sites

You could reduce (but not eliminate) the danger by removing the r from rm -rf

find change_to_your_own_directory/ -type f -name '*.mx' -exec rm -f {} \; 

The r stands for recursive and is what allows rm to delete directories.  Without it, rm will only delete files. Better might be to do something like

find change_to_your_own_directory/ -type f -name '*.mx' -print
find change_to_your_own_directory/ -type f -name '*.mx' -delete

Where you check the files printed by the first line before running the second line. 

Two possibilities that come to mind: 

1.  This is caused by some IDE.  E.g. Dreamweaver MX.

2.  This is a hack attempt of some sort. 

Similar problem reported at https://stackoverflow.com/questions/61875526/mx-files-found-in-wordpress-core-files-with-the-same-core-code -- perhaps that will get a relevant answer. 


Always back up before making changes.

Share this post


Link to post
Share on other sites

@ecartz

Matt, ..you're awesome!!

I don't know shell scripting ..so this will not only help me, but anyone else who comes across this thread.

I have not removed these files just yet. I'm still waiting to see if my hosting company comes up with an answer before cleaning that entire sub-domain.

I did see that stackoverflow.com post when searching for an answer but there were no solutions offered on that post.

And though I still use Dreamweaver (old habits die hard), this is the first time I've experienced this problem. And you might be right on point with this outdated software. Tough to let go of that comfort pillow. lol

Thanks Matt.


osCommerce: made for programmers, ...because store owners do not want to be programmers.

https://trends.google.com/trends/explore?date=all&geo=US&q=oscommerce

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×