How To Find Spam Script
Oct 31, 2009I found a spam script running in the processes under apache as ky.pl. But no matter how
I search I can't seem to find this file, anyone know what is the procedure?
I found a spam script running in the processes under apache as ky.pl. But no matter how
I search I can't seem to find this file, anyone know what is the procedure?
I have a web blog that shows promise of growing pretty big soon! This is a vbulletin whith chatbox and arcade games. The forum is for gamers and game modification talk. I want to keep my features such as in forum mp3 player for streaming music. I host no files everything is linked from outside sources. Even photos are linked from photo hosts. I forsee about 20-30 members on at all time browsing and chatting in chatbox. Playing in the online arcade!
I have no idea how much bandwidth all this will use up. I do know that 20-40 gig of space should be quite enough but as always I want all I can get. As far as bandwidth I have no idea what all those features will eat up.
I have looked at fatcow.com and talked to them they said their unlimited is this 300gig space 3000 gig bandwidth and they do not keep up with msql databases. I looked on BBB and they have an A+ record if compared to hostgator they have unsatifatory! The only problem is they are yearly contract only. I do not trust this! I also have to let them re-bill me at end of year and this gives them access to my account. The payment options are check,paybal, or credit.
I have a dedicated server, the server itself is secure (as far as I know) and I run lots of my sites from it. I offered a friend hosting for his flash based chat application he built.
Today I was contacted by someone; "Are you the owner of xxxx.net?" so I informed that yes, it was my server and they then showed me an email they'd received from my server. I did a search and apparently someone uploaded mail.php and a couple of files it was using to send out spam based upon a variety of conditions that the other files met. The files contained forenames and surnames, it'd use a forename and a surname then send it to popular free mail services. The email contained ramblings about new world order and promoted a website.
How can I find out how they got the files uploaded to the account and what action can I take? I checked the whois for the domain and have their contact information, however it's a large site so I'm doubtful that the owner did it. I don't want my servers IPs being blacklisted for spam :|
Not far ago somebody hacked our customer account through the vulnerability in phpBB Album module and uploaded some scripts. Then it started to send nigerian spam using exim and apache. These scripts were found and deleted and the Album module was fully deleted too. But when I look at the processes now I see that exim and httpd still start very often so the system resources are probably overused by them ......
View 7 Replies View RelatedI facing a serious problem with my qmail and plesk 11.0.9.I found the way spammer did with my server by listening everything on port 25. Maybe he know the RCPT hosts of mine, and they send emails with random username but with domain hosted on my Plesk. (user1@mydomain.com, user2@ my domain.com, ... userxxx@mydomain.com).
qmail only check domain in RCPT if spammer input:"mail from user1@mydomain.com" - (with out ":") - no email address on my server.then server reply: 550, no mailbox here by that name. (#5.7.17)
But qmail check username and domain if spammer input:""mail from: user1@mydomain.com" - (with ":") - no email address on my server. Then server reply: 250 OK..This is really weird! I tried with all my plesk server, this bug still effected.Click to expand...
We have just had reports of SPAM being sent from our CentOS 6.x server running Plesk 12.
Services like Plesk Premium antivirus, SpamAssasin, watchdog(rkhunter) and mod_security are enabled on the server to enhance security and none of these seemed to stop the scripts.
The issue is that multiple domains are sending out mail from this server, so it is difficult to find the script sending out SPAM.
When we were running Plesk 11.0 we had a seperate log-file where we could see the file sending any mail going out from the postfix mailserver. I have check both /var/log/maillog and /usr/local/psa/var/log/maillog, but there is nothing in those files to tell me the file that sent the mail.
How would I go about finding this file from either the Plesk Control Panel or through SSH (using log-files)?
how can i do a search for all files (probs using regex) of files consisting purely of numbers?
for e.g. find:
53243.php
24353.php
24098.php
(always have 5 numbers).
seems one of my accounts has had some script run which generated a bunch of these in various subfolders, and the php file basically does a callback to www3.rssnews.ws and www3.xmldata.info, which seem to be some sort of spyware servers.
Microsoft Windows Server 2008 R2 Service Pack 1
Panel version 11.0.9 Update #59, last updated at Oct 3, 2013 02:06 AM
MailEnable version 5
I see in the plesk documentation that the screen to enable SPAM filtering for an individual there is an option to "Move spam to the Spam folder". I don't see that option so I am wondering if it is only available on some versions of Plesk, or in combination with certain mail servers. How to make that option available?
I can't seem to figure out why this is not working. I want to cd into a directory and only compress certain files. However, what I end up with is a file called ..tgz (I am not sure why it is adding that other dot).
Here is the command line:
find . -mmin +1 -exec tar czf {}.tgz {} ;
I have a CentOS web server at my company. It's dual opteron. That server also acts like a router and I have about 5 computer are connected to that router. My web server has been slowed and can i find out who is using my bw ?. Those 5 computers has only local ips (10.10.0.x).
that my website is just for me, no one else know that website.
Someone posted some code similar to below, I made modifications or two after trying to detect PHP "nobody" users, after dumping a few printenv I found PHP exports PWD when calling an external program such sendmail. Basically the PWD will show the user directory that is coming from, which is enough to detect who is sending SPAM even as nobody! It's not 100% secure in that they could wipe /var/log/formmail but I don't imagine any spam will notice the logger, they presume any cPanel server (or other CP for that matter) is the same.
mv /usr/sbin/sendmail /usr/sbin/sendmail2
pico /usr/bin/sendmail (paste the below code into it)
chmod +x /usr/bin/sendmail
echo > /var/log/formmail
chmod 777 /var/log/formail
#!/usr/local/bin/perl
# use strict;
use Env;
my $date = `date`;
chomp $date;
open (INFO, ">>/var/log/formmail.log") || die "Failed to open file ::$!";
my $uid = $>;
my @info = getpwuid($uid);
if($REMOTE_ADDR) {
print INFO "$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME";
}
else {
print INFO "$date - $PWD - @info";
}
my $mailprog = '/usr/sbin/sendmail.real';
foreach (@ARGV) {
$arg="$arg" . " $_";
}
open (MAIL,"|$mailprog $arg") || die "cannot open $mailprog: $!";
while (<STDIN> ) {
print MAIL;
}
close (INFO);
close (MAIL);
i want to know more about there service.
does any one work with them?
i need more review about them.
in which folder is the crontab generally located.
i run LAMP
also,i m looking for a specific cron right now (xbt_cron).once i find it ,what command do i use to run it manually.its supposed to run by itself..i just moved to a new server last week and now its stopped working.
I tried searching for it on google but couldn't find any server company offering VPS using Litespeed instead of Apache. Yes, I know that Apache could be optimized, but would like to try a VPS or dedicated server with Litespeed, just for testing and learning to use and troubleshoot Litespeed. Does anybody here know of a supplier? I would need less than 10 gigs, 250+ Ram as well as cPanel.
View 13 Replies View RelatedHow can I find a path in my VPS? It uses virtuozzo. I am new to all this so this might be a stupid question..
For example, my host says ffmpeg is in usr/bin/ffmpeg,, how do I find /usr/?
Here's my situation:
I run a site that does a lot of transfers AND uses a lot of CPU resources. I think I would like to get two different hosting plans to deal with these different patterns of usage, but where can I find a good host offering lots of bandwidth that is content to have it actually used? I've been with DreamHost for a while but they don't allow "data archiving" or whatever (and I have arguments against their claims but it's neither here nor there). So, really, where the heck can a guy find a good host offering plenty of space and bandwidth? Keep in mind I need pretty much no CPU power with such a plan; the web server can be stone cold stupid for all I care, as I can just get a VPS to run the CPU-intensive part of my site!
I was wondering how you guys go about finding a host?
Where do you do your research?
What forums do you use?
What else do you do in your process before finding a web host?
Do you subscribe to newsletters or web host magazines?
Weve got a server where the /var is setup at 7gb, which is now %100 full.
Weve deleted the common logs we always notice, but thats only gotten us down to %94.
Anyone have any ideas what we should be cleaning or a good script that might help?
seems 5.5gb of data is in /lib
What is safe to delete from /lib and why is it taking up so much space?
If I have PID 1122 of apche httpd and using 99% CPU. How can I find the crosponding web site name which is utilizing that much CPU so I can the suspend it.
View 1 Replies View RelatedOver the last day. I have noticed that something is suddenly taking up 15gb on my server.
My server is Centos.
How would i find what this is. I have tried for about 1 hour to track this down but cant find anything.
How do i do a search of all files on the server and arranging it by the file size.
waht i do ?
Code:
root@server [~]# service exim restart
Shutting down clamd: [ OK ]
Shutting down exim: [ OK ]
Shutting down antirelayd: [FAILED]
Shutting down spamd: [ OK ]
Starting clamd: [ OK ]
Starting exim-26: [ OK ]
Starting exim: [ OK ]
Starting exim-smtps: [ OK ]
Starting antirelayd: Cannot find the maillog at /usr/sbin/antirelayd line 26.
[FAILED]
Starting spamd: [ OK ]
Assuming that one was to get a local office in a town, how would someone find building or area that had a high availbility of fiber nearby, but was not a datacenter? Are their fiber maps for each big city? Does anyone have fiber maps for Houston, Texas? I would be interested in seeing these maps if possible.
View 5 Replies View RelatedI can't find wget on a hosting. SSH command find / -name wget returns with nothing, however wget works properly on a hosting, what could the problem be?
View 14 Replies View RelatedSome of our servers are complaining that they can't access the website. How can we check the blocked IPs using IP tables rules? Are there any special command to check?
View 3 Replies View RelatedHow can i find shell in my server?
is a program that find them?
my server is linux / centos / cpanel control panel
how can i disable shell in my server?
and stop deface
where can I find free hosts?
View 1 Replies View RelatedJust got alerted that my server is being used to send spam. Here is the information the datacenter gave me:
[information .....]
NOTE: I changed the real domain name and IP only.
Is there an expert who can help me decipher this? How do I find the culprit? My provider is threatening to shut me down and sink all my clients with the ship!
I am running the latest WHM and cpanel server, fyi.
Q. I've a dedicated server and I'd like to find out my servers details [CPU, RAM, HDD] etc. How?
Q. My server comes with two HDDs. How do I access them through the WHM or cPanel?