1

Hello everyone I have Joomla system under DA management. For awhile now I'm receiving into my DA message system alerts that PHP is sending too much emails.

This is the message I'm receiving from Direct Admin:

> The X account has just finished sending 50 emails.
There could be a spammer, the account could be compromised, or just sending more emails than usual.

After some processing of the /etc/virtual/usage/X.bytes file, it was found that the highest sender was nellie_osborne@x.com, at 15 emails.



The most common path that the messages were sent from is /home/x/domains/X.com/public_html/images/stories/virtuemart, at 51 emails (102%).
The path value may only be of use if it's pointing to that of a User's home directory.
If the path is a system path, it likely means the email was sent through smtp rather than using a script.

The top sending script was /home/X/domains/x.com/public_html/images/stories/virtuemart/proxy98.php(1958) : eval()'d code:775, at 30 emails, (60%).



This warning was generated because the 50 email threshold was hit.

Now, it seems like there's multiple PHP's implemented around the system that send out those emails, in this case its proxy98.php and in other cases it was other files that I deleted but it kept sending emails.

Here's a link to the proxy98.php's code.

I'll be more than happy if you could help me sort this thing out.

  • 2
    Your site has been compromised. You need to take immediate actions, to clean it up and secure it. Hire hire experts, If you are in doubt about how to proceed. Check these topics for further help: Joomla Site Hacked | Secure Joomla | Joomla Security Checklist – FFrewin Aug 28 '15 at 14:15
  • 2
    Yup, definitely compromised. Have a read of my answer on Stack Overflow which might be of some help to you: stackoverflow.com/questions/11036763/… – Lodder Aug 28 '15 at 16:38
  • Hi @FFrewin, I suggest you add your comment as an answer so this question can be resolved. Thanks. – Neil Robertson Apr 25 '16 at 12:57
  • Ok I did so, @NeilRobertson – FFrewin Apr 25 '16 at 13:10
1

Your site has been compromised. You need to take immediate actions, to clean it up and secure it. You should hire experts, If you are in doubt or don't know how to proceed.

Check these topics for further help:

  • Althrough I don't clearly remeber what I did and this wasn't the solution it did seem to be a useful stuff, thanks. – Ofir Apr 25 '16 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.