0

I noticed that a folder with the name of a website I removed keeps appearing under /var/www. I checked and it is created by www-data. I suspect that it's something malicious.

How can I find out what causes this?

Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
Dean
  • 979
  • 3
  • 9
  • 19
  • What is the permission of this folder `ls -la /var/www`? – Khaled May 28 '15 at 12:26
  • There are numerous apache functions which create folders on the spot, it is probably not malicious thing, but a configuration setting. – peterh Jun 20 '15 at 08:19

2 Answers2

0

There's nothing that Apache itself would do to create a folder within /var/www. You might have some other software doing it--maybe a configuration panel.

You're right to be suspicious, but you should spend just a little time ruling out something else legit. Apache's not it, though.

Andie Hunt
  • 101
  • 3
-2

Obviously you want the exact process name that causes it. I would suggest something like auditd to monitor the directory in question, and pinpoint the culprit. You can find a lot of tutorials on the web regarding how to set it up and use, so I will not repost it here. If you run into troubles, or do find what causes it, post a comment.

Konrad Gajewski
  • 1,498
  • 3
  • 15
  • 29