Most of the shared servers might be facing the issue of fake PHP code being injected in their sites which may lead to generation of spam mails, redirection to a different site, creation of social engineering URLs etc.

Suggest an effective way to

find out the spam generating scripts which are not located while doing scanning(maldet etc).

stop email spamming

  • I just use version control on the websites I manage. This way doing an update on the source files is easy. I can also nuke out any files I didn't create myself. – Ramhound Oct 6 '16 at 19:23

Locate the home directory(s) which is creating the high mail queue

grep 'cwd=/home' /var/log/exim_mainlog | awk '{print $3}' | cut -d / -f 3 | sort -bg | uniq -c | sort -bg

Locate if any multiple POST operation of any PHP file is occurring in the site under that particular home directory. If yes, check the file and lock it down if you find it suspicious. Also block the IP, if it is from a particular one.

grep POST /usr/local/apache/domlogs/<homedirectory>/* | grep PHP | grep 200 

I found the “Pattern 1” in most of the infected files.         

Pattern 1 

  grep -irl "GLOBALS.*eval" . | xargs ls -la | grep php

Pattern 2

grep -irl "Array.*eval" . | xargs ls -la | grep php

Pattern 2 is common in PHP files and compressed jquery files. But this pattern is also found in some infected files. So, you should open each file and check whether malicious code is present or not.

Pattern 3 (Fake jQuery injections)

   grep -irl "jQuery.min.php" . | xargs ls -la

Detailed information about jQuery.min.php Malware :https://blog.sucuri.net/2015/11/jquery-min-php-malware-affects-thousands-of-websites.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.