We were running out of space on our server so we did a search for large files we could delete and found one in htdocs/media/catalog/product/N/o/ called "NoImages100_184x.jpg" which was 112MB. It was also present in our test environments in sizes varying from 60-240MB. My web guy and I had no idea what this was, so we downloaded the file to both a Mac and PC and tried to open it. No luck. Said that file was corrupt or the wrong file type. So, we deleted the file. And it reappeared with 600 permissions and owned by the webserver user. Instantly. Small, just a couple of k. Then it started growing. 5k, 6k, 7k, 8k, 9k, etc. I did a tail -f on the file and there was a line getting written to it just about every second. Most of the lines looked like this:
"YToxOntzOjI6ImlkIjtzOjg6Ilc5SE03SDhCIjt9LS1hOjA6e30="
with 10 characters to the right of center changing each time it was written, but the rest of the line remaining the same. The file has no header, just starts right in with those cryptic lines, just like a log file.
I ran ClamAV and found no viruses or anything. I grepped my Magento installation looking for a file that referenced the jpg filename, but found nothing.
Finally I just changed permissions on the file to 400, and it stopped growing.
I did tail -f on the file in one of our test environments and it was static. Of course, the test environment doesn't have traffic and cron is not running. Even so, I tried loading some webpages, and running cron.php from the browser, and the file remained static.
Web searches for the filename, the directory name, related keywords, stuff like "growing JPG file yielded no results. We searches for some of the strings inside the file likewise were fruitless.
Can anybody shed some light on this. I'm more than a little freaked out.
