A friend of mine has a few small businesses and hosts Wordpress-based sites for them on a dedicated host. The Wordpress installs were neglected for awhile and the host ended up getting compromised. There's now 100's of spam messages going out every second. What can I look at to determine what's generating the mail?

The only way I can get the spam to stop is to shutdown Postfix. We've had it off for a few days to prevent spamming, but this also means he can't send mail from his businesses addresses.

If I shutdown both apache and postfix, netstat shows no remote connections except my SSH login. If I then start postfix (but leave apache stopped), 100's of remote connections to port 25 immediately open. This leads me to believe that some process on the host is doing this, rather than something coming in through Wordpress/some rogue script that we missed in the clean-up. There were also IRC bots on here, but we've removed those, and netstat no longer shows any open connections to IRC.

When I look at ps axjf - all of the smtp processes roll up to /usr/libexec/postfix/master, which has a parent id of 1. This doesn't really give me an idea of where the mail is being generated.

Neither ps nor top show any suspicious processes (as far as I can tell).

What else can I look at to see what's creating/sending the mail? I can post the output of ps whatever_flags_you_want both with and without postfix running, if it will help.

Thanks.


Question: php escape sequence not working
Answer: Try This:

&lt;pre&gt;&lt;?php
   echo "\t\t hello!&lt;br&gt;";
   echo "\t\t", "hello!&lt;br&gt;";
   echo "\t\t"."hello!&lt;br&gt;";
?&gt;&lt;/pre&gt;


I would say you are probably viewing the generated page (html) rather than the page source.