Server Help!

[ashutariyal]

Is there is any way in a linux server with whm to stop sending mails to a particular email id (from server's php script) or redirect it other email id.

Please help!

ashutariyal Reviewed by ashutariyal on 30th Sep 2010. Server Help! Is there is any way in a linux server with whm to stop sending mails to a particular email id (from server's php script) or redirect it other email id. Please help! Rating: 5

[th3fallen]

You mean like server notification emails or just marketing emails?

[Sponge Bob]

Hello,

Please illustrate more. What exacrtly is it doing. Is there a script on the server sending out very many emails to one person or many? There must be a cronjob also setup or something.

Also what kind of emails are those being sent out?

[ashutariyal]

Thanks for your reply,

this is one kind of hacking and i have checked every script and found that it is "X-Mailer: DLE PHP" so i have replaced all files with new one but the script (which i still not found) still sending mails to a gmail email id in this formate

Acount: [  Editor  | username | passowrd | email id | ip ] -     Admin mail:  
 Hack Shell: http:// link of the script (which i already removed)

in every email only one account detail.

(which is killing my exim and server going overload)

Regards,

[Gavo]

Config Mail Manage

install this WHM plugin and you can limit each domains mails per hour and set config options per domain.

cd /
wget http://www.configserver.com/free/cmm.tgz
tar -xzf cmm.tgz
cd cmm/
sh install.sh 

but you should secure/update your script to solve the problem

[th3fallen]

Couldn't have said it better myself.

[ashutariyal]

or is there is any way to find out this script on server / account
hacker's gmail id is : noreply.hak@gmail.com

[Sponge Bob]

Also check the cronjob must be active

Check this :

go to /etc/crontab

then do a ls

and see any cronjobs and delete them.

Thanks & Regards

[Gavo]

search starting /
it will take a long time to search through all files on the server.


http://www.siteground.com/tutorials/..._searching.htm

[th3fallen]

You can try doing a grep -RPn for some of the following they are very common vars of exploits

• passthru
• shell_exec
• system
• phpinfo
• base64_decode
• edoced_46esab (base64_decode used backwards to avoid detection by string searches like this)
• chmod
• mkdir
• `` (backticks with an operating system command between them)
• fopen
• fclose
• readfile

Granted this may give alot of false positives but is better than nothing.