My server's been hacked EMERGENCY
PHP file is sending e-mail's from my server. Is there maybe someone who can tell me how i can find the file that is sending mail's from my server.
its like a worm.
You can try to find the php file that contains the mail function by using grep. For instance:
If the mail is sent using the
Now, specify that wrapper in your
You will now see a log entry in your
How do you know it's a PHP file that's sending the mail?
If it is definitely a PHP file and it's being requested from Apache, look in Apache's access logs.
If it's running from the command line on your server, a variation on Lucas Kauffman's answer might help you to find it as these files are nearly always deleted after they are executed but even deleted files can still be found in
Or if the file wasn't named ".php":
Both commands need to be run as root,
If it was running on the command line and not being requested in Apache, someone else has control of your server. If you can't figure out how they got in quickly, just nuke it, reinstall from backups and upgrade everything in the hope that there's a fix to whatever flaw they used in the upgrade.