On 2017 Sep 17 11:02:00, you wrote to me:

 KQ>>> I beieve i've actually seen photo,scr replicate also.. all I used to
 KQ>>> have left was one upload directory, and found that file in multiple
 KQ>>> directorys after being away from the system a few days.

 ML>> it cannot replicate just sitting there... self-replication requires
 ML>> that it is executed and if you had done that, then you would have had
 ML>> an infestation to clean up... more likely is that someone found
 ML>> another way to upload it to those other areas... your logs should be
 ML>> able to tell you more...

 KQ> well.. I believe when the system was updating the filelist (addfiles)
 KQ> it replicated.. there would be no other possible way for it to move
 KQ> from the only upload directory I had to the root directory of the
 KQ> drive my BBS was on.. and I did'nt execute this file in any manners
 KQ> whatsoever..

file list updates don't/can't execute them anyway... all we're doing is taking
a DIR output and massaging it a little for display with the files' entries in
the FILES.BBS file or some other file data storage database format...

occam's razor says that most likely an anonymous "user" uploaded them with a
scripted ftp bot that simply walked all the directories and tried to upload the
file in each one of them...

)\/(ark

Always Mount a Scratch Monkey
Do you manage your own servers? If you are not running an IDS/IPS yer doin' it
wrong...
... Simple, soggy and sweet: the three "S's" of British cuisine.
---