I recall seeing a post about this before - but could re-find it.
I noticed on almost all my folders on my cs-cart store - files called 178240.php and 173302.php
Does anyone know what this means exactly to my site? Should I manually remove them all, will they come back?
This is the contents of one of them:
Remove them now… and quickly.
If they’re “appearing” then there’s something wrong with the server…
These files are Trojans that run code located on a remote server. Also check your .htaccess files for additions related to ErrorDocument fowarding.
These files require allow_url_fopen set to on so having your host disable that will prevent their ability to run the remote code. This does not solve your problem though. Your account has been compromised so a full security audit should be done on all other files and that server which is obviously insecure.