what php file is sending e-mail's from my server [duplicate]

Question

Possible Duplicate:
My server's been hacked EMERGENCY

PHP file is sending e-mail's from my server. Is there maybe someone who can tell me how i can find the file that is sending mail's from my server.

its like a worm.

Answer 1

You can try to find the php file that contains the mail function by using grep. For instance:

grep -i "mail" *.php

Answer 2

If the mail is sent using the mail() function you could write a wrapper for /usr/sbin/sendmail:

#!/bin/sh
/usr/bin/logger -p mail.info "phpmail: pwd=${PWD}"
/usr/sbin/sendmail -t -i $*

Now, specify that wrapper in your php.ini:

sendmail_path = <path to wrapper>

You will now see a log entry in your mail.log indicating in what directory the script is.

Answer 3

How do you know it's a PHP file that's sending the mail?

If it is definitely a PHP file and it's being requested from Apache, look in Apache's access logs.

If it's running from the command line on your server, a variation on Lucas Kauffman's answer might help you to find it as these files are nearly always deleted after they are executed but even deleted files can still be found in /proc if some process has them open.

grep mail /proc/*/fd/*.php

Or if the file wasn't named ".php":

grep mail /proc/*/fd/*

Both commands need to be run as root, sudo won't be adequate.

If it was running on the command line and not being requested in Apache, someone else has control of your server. If you can't figure out how they got in quickly, just nuke it, reinstall from backups and upgrade everything in the hope that there's a fix to whatever flaw they used in the upgrade.