Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
How do I deal with a compromised server?

Following message i got from my VPS provider.

How can i track this message? How to track sender or script?

____________________________________________________________________________
Email from xxx.xxx.xxx.xxx / Sat, 29 Dec 2012 17:51:15 -0800
http://www.spamcop.net/w3m?i=z5896128877z154f8efa0e66d69c2ea2a2d17c0a3689z

[ Offending message ]
x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; spf=none (sender IP is xxx.xxx.xxx.xxx) smtp.mailfrom=herminia_miles@xxx.xx; dkim=none header.d=xxx.xx; x-hmca=none
X-SID-PRA: herminia_miles@xxx.xx
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Message-Info: 11chDOWqoTkwsv9ZisdxezOlMxmrtTtpgmSywBjlRP0Bl0xE3XbZM0J1Gj967vOrHHEsYWiN6QfeVfybT6JElW6TdXgqcrYXQbHk8PuWatjfqKIH+MR8cHummlfxjZw1m+dWeIh9WDYtopWWtGLNVV2deDCcDnfx
Received: from li556-147.localdomain ([xxx.xxx.xxx.xxx]) by COL0-MC2-F27.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Sat, 29 Dec 2012 17:51:15 -0800
Received: by li556-147.localdomain (Postfix, from userid 48)
id 232A7452CA3; Sun, 30 Dec 2012 07:20:44 +0530 (IST)
To: "Markus Henauer" <mhenauer@hotmail.com>
Subject: FW: WOW, Markus
X-PHP-Originating-Script: 48:sslnvA.php
From: "Herminia Miles" <herminia_miles@xxx.xx>
Reply-To: "Herminia Miles" <herminia_miles@xxx.xx>
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Message-Id: <20121230015044.232A7452CA3@li556-147.localdomain>
Date: Sun, 30 Dec 2012 07:20:44 +0530 (IST)
Return-Path: herminia_miles@xxx.xx
X-OriginalArrivalTime: 30 Dec 2012 01:51:15.0786 (UTC) FILETIME=[276C9AA0:01CDE630]

To: mhenauer@hotmail.com
Subject: FW: WOW, Markus
From: herminia_miles@xxx.xx
Date: Sun, 30 Dec 2012 07:20:44 +0530


Hey Markus is this your sisters video? OMG She is hot, but doesnt she know everyone can see? check here

share|improve this question

marked as duplicate by Michael Hampton, Scott Pack, Ward, Alex, voretaq7 Jan 7 '13 at 17:39

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
You don't tell us what troubleshooting you've already done. Assuming you've verified that this is originating on your server, verify that your mail server is not acting as an open relay. If you're sure that's not the problem proceed through your server's logs to determine if the system was compromised, and and if it is compromised proceed per the linked duplicate question. If you have specific questions on any of these aspects feel free to ask a new question... –  voretaq7 Jan 7 '13 at 17:41

1 Answer 1

If you've got a windows host, download the program Sam Spade (just google it, it's available for free on several sites).

If not, you need to be able to read the headers and understand them. A good place to start is at http://www.dmuth.org/spam-l/tracking.html, it has lots of information about tracking spam.

Since you've chosen to munge a lot of the relevant information, it's very hard to help you with this particular mail. It'd be a lot easier if you'd kept the original hostnames and ip addresses. It's entirely possible that this email wasn't even sent through your system, but since you're hiding all that information, I can't tell.

share|improve this answer
    
Thanks Jenny... –  Sameer Jan 7 '13 at 9:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.