ConfigServer Community Forum

Hello,

Since a few days, I'm getting this for each file of a php script:

Time: Mon Oct 29 14:40:36 2007
File: /tmp/b0692f57_TemplatePatch.class.php
Reason: Script, file extension
Owner: nobody:nobody
Action: Moved into /etc/csf/suspicious.tar

I suppose it's coming from Fantastico, how can I allow it ?

Thanks,
Francois

I wouldn't allow it. A quick search for the filename, TemplatePatch.class.php shows many broken sites. This is nothing to do with CSF though, other than its protecting your server which is a good thing. You should probably head over to Netenberg/Fantastico and ask them about it if you suspect a Fantastico script.

You might also take a closer look at: /etc/csf/suspicious.tar and see exactly whats in it.