1

Hello everyone I have Joomla system under DA management. For awhile now I'm receiving into my DA message system alerts that PHP is sending too much emails.

This is the message I'm receiving from Direct Admin:

> The X account has just finished sending 50 emails.
There could be a spammer, the account could be compromised, or just sending more emails than usual.

After some processing of the /etc/virtual/usage/X.bytes file, it was found that the highest sender was nellie_osborne@x.com, at 15 emails.



The most common path that the messages were sent from is /home/x/domains/X.com/public_html/images/stories/virtuemart, at 51 emails (102%).
The path value may only be of use if it's pointing to that of a User's home directory.
If the path is a system path, it likely means the email was sent through smtp rather than using a script.

The top sending script was /home/X/domains/x.com/public_html/images/stories/virtuemart/proxy98.php(1958) : eval()'d code:775, at 30 emails, (60%).



This warning was generated because the 50 email threshold was hit.

Now, it seems like there's multiple PHP's implemented around the system that send out those emails, in this case its proxy98.php and in other cases it was other files that I deleted but it kept sending emails.

Here's a link to the proxy98.php's code.

I'll be more than happy if you could help me sort this thing out.

1

Your site has been compromised. You need to take immediate actions, to clean it up and secure it. You should hire experts, If you are in doubt or don't know how to proceed.

Check these topics for further help:

  • Althrough I don't clearly remeber what I did and this wasn't the solution it did seem to be a useful stuff, thanks. – Ofir Apr 25 '16 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.