Suspicious .listing file inside each PrestaShop folder

[ballashop]

Hi, I found a .listing file on the server inside each folder.

this is the contents of the .listing file into the main root 

drwxr-xr-x   32 188530608  188530608        8192 Oct 29 08:36 .
dr-xr-xr-x    2 188530608  188530608        4096 Jul 16 13:33 ..
-rw-r--r--    1 188530608  188530608        5155 Oct 11 05:05 .htaccess
-rw-r--r--    1 188530608  188530608         223 Jul 15 08:44 .user.ini
-rw-r--r--    1 188530608  188530608         220 Jul  2 15:46 .user.ini.07152020084442
-rwxr-xr-x    1 188530608  188530608        5052 Oct 11 05:02 INSTALL.txt
-rwxr-xr-x    1 188530608  188530608         441 Feb 12  2020 Install_PrestaShop.html
-rwxr-xr-x    1 188530608  188530608      187825 Oct 11 05:02 LICENSES
-rwxr-xr-x    1 188530608  188530608        2331 Feb 12  2020 XMLFeed.cache
drwxr-xr-x    9 188530608  188530608        4096 Oct 29 08:06 adminfolder
-rwxr-xr-x    1 188530608  188530608      489307 Oct  6 14:03 adminer-4.7.7.php
drwxr-xr-x    5 188530608  188530608        4096 Oct 29 08:06 app
-rwxr-xr-x    1 188530608  188530608        1263 Oct 11 05:02 autoload.php
drwxr-xr-x    2 188530608  188530608        4096 Oct 29 08:06 bin
drwxr-xr-x    9 188530608  188530608        4096 Oct 29 08:06 cache
drwxr-xr-x    2 188530608  188530608        4096 Oct 29 08:06 cgi-bin
drwxr-xr-x   24 188530608  188530608       12288 Oct 29 08:06 classes
-rwxr-xr-x    1 188530608  188530608      314549 Oct 11 05:02 composer.lock
drwxr-xr-x    5 188530608  188530608        4096 Oct 29 08:06 config
drwxr-xr-x    4 188530608  188530608        4096 Oct 29 08:06 controllers
drwxr-xr-x    6 188530608  188530608        4096 Oct 29 08:06 docs
drwxr-xr-x    2 188530608  188530608        4096 Oct 29 08:06 download
-rwxr-xr-x    1 188530608  188530608        2466 Oct 11 05:02 error500.html
-rwxr-xr-x    1 188530608  188530608        4777 Oct 11 05:02 images.inc.php
drwxr-xr-x   18 188530608  188530608        4096 Oct 29 08:06 img
-rwxr-xr-x    1 188530608  188530608        1116 Oct 11 05:02 index.php
-rwxr-xr-x    1 188530608  188530608        1203 Oct 11 05:02 init.php
drwxr-xr-x    7 188530608  188530608        4096 Oct 29 08:06 js
drwxr-xr-x    3 188530608  188530608        8192 Oct 29 08:06 localization
drwxr-xr-x    5 188530608  188530608        4096 Oct 29 08:06 mails
drwxr-xr-x  119 188530608  188530608       12288 Oct 29 08:06 modules
drwxr-xr-x    5 188530608  188530608        4096 Oct 29 08:06 override
drwxr-xr-x    2 188530608  188530608        4096 Oct 29 08:06 pdf
-rwxr-xr-x    1 188530608  188530608      469753 Mar  5  2020 php
drwxr-xr-x    2 188530608  188530608        4096 Oct 29 08:36 plesk-migrator-agent-kvmuhb0rwvtva8ovkitfphoodzi5tngx
-rw-r--r--    1 188530608  188530608        3437 Aug  3 07:07 robots.txt
drwxr-xr-x    5 188530608  188530608        4096 Oct 29 08:06 src
drwxr-xr-x    6 188530608  188530608        4096 Oct 29 08:06 themes
drwxr-xr-x    4 188530608  188530608        4096 Oct 29 08:06 tools
drwxr-xr-x    4 188530608  188530608        4096 Oct 29 08:06 translations
drwxr-xr-x    2 188530608  188530608        4096 Oct 29 08:06 upload
drwxr-xr-x    5 188530608  188530608        4096 Oct 29 08:06 var
drwxr-xr-x   46 188530608  188530608        4096 Oct 29 08:06 vendor
drwxr-xr-x    2 188530608  188530608        4096 Oct 29 08:06 webservice

I wanted to ask the developer community if these are PresaShop core files.

Thanks a lot for any reply.

Balla

Edited March 3, 2021 by ballashop (see edit history)

[musicmaster]

It is not Prestashop.

My guess would be that it is from some anti-malware program that this way keeps track whether things have been changed.

[ballashop]

Hi @musicmaster

thanks for replying the post.

The server technical support wrote me that they didn't know about those file, they are waiting for confirmation from us to delete all files. The files are approximately 32789.

Thanks for any reply.

Balla

[musicmaster]

It is not hard to delete those files. FileZilla has a search function for that.

[ballashop]

Hi @musicmaster

I try to do it locally and check if it creates problems for the site.

thanks a lot.

Balla

[ballashop]

Hi @musicmaster

can you tell me how to delete all files with filezilla? I don't find info about it.

Thanks a lot.

Balla

[musicmaster]

My FileZilla is in Dutch. So I don't know the terms in other languages.

Anyway, in the FZ menu you choose

    Server -> Search in External files

Then you get a window like in the image below. If you do the search right you will see all the .listing files in the lower window. You ca then select all with ctrl-A and rightclick to get an option to delete them.

[ballashop]

Hi @musicmaster

thanks a lot, really useful.

Balla