This question is similar to
How to find which script on my server is sending spam emails? , but since it doesn't allow answer anymore (marked as duplicated), I am answering it here to provide some insights.
/etc/php5/apache/php.ini by adding those two lines:
mail.add_x_header = On
mail.log = /var/log/phpmail.log
php5 or php5-fpm service and nginx/apache service, then check
/var/log/phpmail.log file to see what script had trigger error, and remove them!
Here is the very specific scope (my solution doesn't solve other scenario):
I am running Ubuntu in a VPS and had
nginx, php5-fpm, and wordpress installed, and it get hacked, and I am pretty sure it was WP get hacked and spam codes were injected.
I tried the following actions to fix; such as used Linux malware detector; reset all database connection credentials; and simply eye-browsing to remove malicious codes.
Some actions I took are:
- reset all database passwords
- login wp-admin, remove unintended admin user
- install wordfence to do defense
For source code:
- you can do a diff with official wordpress code with yours, and see what are changed
- weird folders in the WP root directory
- some files ending with *.suspected
- weird files names like
eval of all your files to see anything malicious
- check any
php files that have obfuscated code
After I done those, I also remove the execute permission of all files except directory:
chmod -x+X -R *
or refer here: remove execute permissions from files without touching folder
However, I still see many errors in my
/varlog/syslog, because I didn't configure
postfix (you can stop such services to expose the spam error):
postfix/sendmail: fatal: open /etc/postfix/main.cf: No such file or directory
However, I still don't know where are the spamming scripts are... stuck here...
After searching several hours, I found the above solution mentioned in short answer , config your mail settings in
php.ini and expose the location of the scripts.
After removing those scripts, I found no more spam errors, and so far my server looks clean.
Although as many suggested, you are supposed to take such server offline and do a reimage or reset to a previous status, etc.
How do I deal with a compromised server?