Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I apologize if this is already asked a million times.

One of accounts on my server got hacked. An email spam sending script is injected and sending ton of emails to some random addresses.

I have cPanel/WHM on my server WHM 11.38.0 (build 5) Also it is CENTOS 5.9 x86_64

I usually don't use cPanel nor WHM I have it on this server from the start and later I was too busy to setup an non WHM based server.

What I did up until now:

  1. I blocked problematic account from sending emails at all from WHM
  2. I executed this command exim -bp | grep \< | awk '{print $3}' | xargs exim -Mrm since I got 70k emails in mail queue
  3. I restarted the server

Currently I cant easily change password for that email account.

Is there a way to see what process exactly, or much better what script is sending those mails and where is it located?

Thank you in advance and if you need some additional info to help me just ask.


I have looked in crontab for that user and there were nothing suspicious in it. Thank you in advance and if you need some additional info to help me just ask.


Here is an screenshot of top command executed and I pointed to my suspect: ssh top email spam script

Aside from pointed process there are a lot of "mailnull" processes. What can I do about it?

share|improve this question
up vote 2 down vote accepted

If you know the mail account the spam comes from, you will definitely have to change the password. How do you know the spam is sent via some script?

If it is sent via some vulnerable (PHP?-)script, to find out where it comes from, you should create a sendmail wrapper, as scripts are usually using the sendmail binary to send out mails.

Create a file /usr/sbin/sendmail-wrapper with this content:

TODAY=`date -Iseconds`
echo $TODAY sendmail-wrapper called $USER from $PWD >>/tmp/mail.send
(echo X-Additional-Header: $(dirname $PWD);cat) | /usr/sbin/sendmail-real "$@"

To get your wrapper active, move the real sendmail binary:

mv /usr/sbin/sendmail /usr/sbin/sendmail-real

and move the wrapper:

mv /usr/sbin/sendmail-wrapper /usr/sbin/sendmail

Everytime sendmail is called, it will add an additional header to the mail and will log the path sendmail was called from to /tmp/mail.send . This way, you should be able to find the problematic script.

Make sure to put the original sendmail binary back in place afterwards to stop /tmp/mail.send from growing indefinitely.

share|improve this answer
Your answer is quite interesting, I will try to do what you described. – Dušan Radojević May 8 '13 at 20:00

Maybe a php script is exploited If you are running php 5.3.x or over set :


in php.ini.
Also make sure that /var/log/phpmail is world writeable , so every php process can write it.
Then restart apache.

After this check the headers of outgoing mail's, should contain the name of php script (X-PHP-Originating-Script)

share|improve this answer

can you disable user clubmaga? why can't you change clubmaga's password? have you tried to kill or kill -9 your suspected evil proggy? purge the mail-queue assuming you can? is your system up to date?

Until you know how you were compromised you are still compromised - as far as you know the bad guy is still on the machine and even if not since you are not willing/able to change passwords your machine is still totally available.

Unless you really know what you are doing you should either clean install or restore a backup you know is clean. Anything else will likely have little positive effect as you are still compromised or at least comprisable in the same way that already worked.

share|improve this answer
I don't know what to kill because there are a lot of processes that are running exim even from root user. I know that an clean install with clean backups is the best solution but I can't do that now. If there is a way to know where is injected script located that would be perfect :) – Dušan Radojević May 8 '13 at 19:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.