Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

PHP file is sending e-mail's from my server. Is there maybe someone who can tell me how i can find the file that is sending mail's from my server.

its like a worm.

share|improve this question

marked as duplicate by mdpc, Iain May 11 '12 at 9:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
serverfault.com/questions/218005/… –  jscott May 11 '12 at 2:29
add comment

3 Answers

You can try to find the php file that contains the mail function by using grep. For instance:

grep -i "mail" *.php
share|improve this answer
add comment

If the mail is sent using the mail() function you could write a wrapper for /usr/sbin/sendmail:

#!/bin/sh
/usr/bin/logger -p mail.info "phpmail: pwd=${PWD}"
/usr/sbin/sendmail -t -i $*

Now, specify that wrapper in your php.ini:

sendmail_path = <path to wrapper>

You will now see a log entry in your mail.log indicating in what directory the script is.

share|improve this answer
add comment

How do you know it's a PHP file that's sending the mail?

If it is definitely a PHP file and it's being requested from Apache, look in Apache's access logs.

If it's running from the command line on your server, a variation on Lucas Kauffman's answer might help you to find it as these files are nearly always deleted after they are executed but even deleted files can still be found in /proc if some process has them open.

grep mail /proc/*/fd/*.php

Or if the file wasn't named ".php":

grep mail /proc/*/fd/*

Both commands need to be run as root, sudo won't be adequate.

If it was running on the command line and not being requested in Apache, someone else has control of your server. If you can't figure out how they got in quickly, just nuke it, reinstall from backups and upgrade everything in the hope that there's a fix to whatever flaw they used in the upgrade.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.