Hello everyone I have Joomla system under DA management. For awhile now I'm receiving into my DA message system alerts that PHP is sending too much emails.
This is the message I'm receiving from Direct Admin:
> The X account has just finished sending 50 emails.
There could be a spammer, the account could be compromised, or just sending more emails than usual.
After some processing of the /etc/virtual/usage/X.bytes file, it was found that the highest sender was nellie_osborne@x.com, at 15 emails.
The most common path that the messages were sent from is /home/x/domains/X.com/public_html/images/stories/virtuemart, at 51 emails (102%).
The path value may only be of use if it's pointing to that of a User's home directory.
If the path is a system path, it likely means the email was sent through smtp rather than using a script.
The top sending script was /home/X/domains/x.com/public_html/images/stories/virtuemart/proxy98.php(1958) : eval()'d code:775, at 30 emails, (60%).
This warning was generated because the 50 email threshold was hit.
Now, it seems like there's multiple PHP's implemented around the system that send out those emails, in this case its proxy98.php and in other cases it was other files that I deleted but it kept sending emails.
Here's a link to the proxy98.php's code.
I'll be more than happy if you could help me sort this thing out.
