A friend of mine has a few small businesses and hosts Wordpress-based sites for them on a dedicated host. The Wordpress installs were neglected for awhile and the host ended up getting compromised. There's now 100's of spam messages going out every second. What can I look at to determine what's generating the mail?

The only way I can get the spam to stop is to shutdown Postfix. We've had it off for a few days to prevent spamming, but this also means he can't send mail from his businesses addresses.

If I shutdown both apache and postfix, netstat shows no remote connections except my SSH login. If I then start postfix (but leave apache stopped), 100's of remote connections to port 25 immediately open. This leads me to believe that some process on the host is doing this, rather than something coming in through Wordpress/some rogue script that we missed in the clean-up. There were also IRC bots on here, but we've removed those, and netstat no longer shows any open connections to IRC.

When I look at ps axjf - all of the smtp processes roll up to /usr/libexec/postfix/master, which has a parent id of 1. This doesn't really give me an idea of where the mail is being generated.

Neither ps nor top show any suspicious processes (as far as I can tell).

What else can I look at to see what's creating/sending the mail? I can post the output of ps whatever_flags_you_want both with and without postfix running, if it will help.

Thanks.


Question: Populate a JSON into a table in real time with JQUERY
Answer: If real-time updating is truly required, as Neal suggested, Comet or Stream-Hub would be one avenue worth checking into.

As for the interface, I recently have been using JQuery Templates, and when reconciling added / removed / updated records, I use JQuery selectors to clear &amp; update, and use Templates to add in new records.  And because I'm using JQuery in all 3 events, I could easily integrate their motion / visual effects.

JQuery Templates

JQuery Selectors

JQuery Effects

Stream-Hub

I myself only needed polling (every 15 seconds) so I'm using Robert Fischer's improved JQuery PeriodicalUpdater

JQuery Periodical Updater