My server's been hacked EMERGENCY
I have a configured dovecot + postfix + mysql. Few days ago i have received abuse from DC that i am sending spam.
And really in the /var/log/mail.log i have found records of sending mails not by me , or my website. I have blocked outgoing 25 port as a precoution. First of all i have greped all the PHP scripts for base64_decode, eval and so on. No success. Also i have turned mail function from php by adding it to disable_function list. But spam is still going from my server and i do not understand where does it come from. Which application or which script causes that.
In /var/log/mail* logs i only see the fact that email was sent. I can see the content of it looking into /var/spool/postfix/... . But i need to find the PID or the PHP script which sends it.
Do you have any ideas on how to do it? I see that email comes from "root@..." so maybe it`s root-level running backdoor or something. Please, help.