Re: [fsug-tvm] Spamming Script from OpenCart Project
JeevZ <[email protected]> Sat, 20 Feb 2016 12:11:52 +0530
| Newsgroups | gmane.org.user-groups.linux.ilug-tvm,gmane.org.fsf.india.fsf-friends |
|---|---|
| Message-ID | <CA+f580_BFkkOCftd-iu_KNh=PxrVyx2zGZya=vX8rte64dwH8g@mail.gmail.com> |
--001a114389d4209d64052c2de5ca Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello All, thanks you for suggestions and help. So, the first step is to disable php mail and use SMTP for all mails. Once > mail is disabled, all requests to mail function can be logged as an error= . > @Manu, Is it possible to disable php mail function to particular account. All of our projects are in our VPS but there is one particular website is actually having this spamming problem. My doubt is if I disable this php mail function, would not it disable mail functions in all other website projects resides in VPS ? Is there any option to disable php mail function to a particular website only in a VPS ? To find the spam mail source from you application. first check the email content from the mail queue. postcat -q queue ID. @Kevin thanks for the suggestions. We have inspected for the spamming php files and we have cleared it many times. But the issue is each time we clear an infected php file, after one week or so, another new spamming php is being generated. Is there any way to fix this ? pls help, the issue is sever and gmail already blacklisted our IP :( ** Jai Bhim -- JeevZ -- *Jeevachaithanyan Sivanandan +919446196667 http://jeevanism.wordpress.com/ -- I Take Refuge On The Enlightened Wisdom -- -- =E0=B4=AC=E0=B5=81=E0=B4=A6=E0=B5=8D=E0=B4=A7=E0=B4=82,=E0=B4=A7=E0=B5= =BC=E0=B4=AE=E0=B4=82, =E0=B4=B8=E0=B4=82=E0=B4=98=E0=B4=82 =E0=B4=B6=E0= =B4=B0=E0=B4=A3=E0=B4=82 =E0=B4=97=E0=B4=9A=E0=B5=8D=E0=B4=9B=E0=B4=BE=E0= =B4=AE=E0=B4=BF -- * On Thu, Feb 18, 2016 at 3:01 PM, kevin sha <[email protected]> wrote: > Hi, > > To find the spam mail source from you application. first check the email > content from the mail queue. > postcat -q queue ID. > > check the origin section, then you can see the location of php file. > > or > > it is better to scan the application using malware scanning tool like > maldect. maldect is a good tool. > > > https://www.rfxn.com/projects/linux-malware-detect/ > > http://www.woktron.com/secure/knowledgebase/145/Installation-Linux-Malwar= e-Detect-Maldet-On-CentOS.html > > http://www.2daygeek.com/install-linux-malware-detect-lmd-on-ubuntu-centos= -debian-fedora-mint-rhel-opensuse/# > > > Thank you > > > On Wed, Feb 17, 2016 at 10:24 AM, JeevZ <[email protected]> wrote: > >> Hello, >> >> This is an offtopic, a help seeking message. >> >> We have done a project on OpenCart which is residing in our VPS. Somehow= m >> one malicious script is creating Spam Emails. We have found out that php >> file and cleared it. But this repeats again and dynamically such spam >> sending scripts are being generated. This makes entire vps server fail a= nd >> other serious problems. >> >> We have inspected for base64 encryption and other normal method find suc= h >> malicious code but none to find. We have changed passwords several time= s >> but still the issue persists. >> >> >> Is there any one here who has some experience on this ? the problem is w= e >> cannot locate which files creates spam sending scripts dynamically. >> >> >> please help >> >> >> thank you >> >> >> ** >> Jai Bhim >> -- JeevZ -- >> >> *Jeevachaithanyan Sivanandan >> +919446196667 >> http://jeevanism.wordpress.com/ >> -- I Take Refuge On The Enlightened Wisdom -- >> -- =E0=B4=AC=E0=B5=81=E0=B4=A6=E0=B5=8D=E0=B4=A7=E0=B4=82,=E0=B4=A7=E0= =B5=BC=E0=B4=AE=E0=B4=82, =E0=B4=B8=E0=B4=82=E0=B4=98=E0=B4=82 =E0=B4=B6= =E0=B4=B0=E0=B4=A3=E0=B4=82 =E0=B4=97=E0=B4=9A=E0=B5=8D=E0=B4=9B=E0=B4=BE= =E0=B4=AE=E0=B4=BF -- >> * >> >> >> >> >> >> >> >> This email has been sent from a virus-free computer protected by Avast. >> www.avast.com <https://www.avast.com/sig-email> >> <#601046615_-1023183722_DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2> >> >> -- >> -- >> "Freedom is the only law". >> "Freedom Unplugged" >> http://www.ilug-tvm.org >> >> You received this message because you are subscribed to the Google >> Groups "ilug-tvm" group. >> To control your subscription visit >> http://groups.google.co.in/group/ilug-tvm/subscribe >> To post to this group, send email to ilug-tvm-/[email protected] >> To unsubscribe from this group, send email to >> ilug-tvm-unsubscribe-/[email protected] >> >> >> >> For details visit the google group page: >> http://groups.google.com/group/ilug-tvm?hl=3Den >> >> --- >> You received this message because you are subscribed to the Google Group= s >> "Free Software Users Group, Thiruvananthapuram" group. >> To unsubscribe from this group and stop receiving emails from it, send a= n >> email to ilug-tvm+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected] >> For more options, visit https://groups.google.com/d/optout. >> > > -- > -- > "Freedom is the only law". > "Freedom Unplugged" > http://www.ilug-tvm.org > > You received this message because you are subscribed to the Google > Groups "ilug-tvm" group. > To control your subscription visit > http://groups.google.co.in/group/ilug-tvm/subscribe > To post to this group, send email to ilug-tvm-/[email protected] > To unsubscribe from this group, send email to > ilug-tvm-unsubscribe-/[email protected] > > > > For details visit the google group page: > http://groups.google.com/group/ilug-tvm?hl=3Den > > --- > You received this message because you are subscribed to the Google Groups > "Free Software Users Group, Thiruvananthapuram" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ilug-tvm+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected] > For more options, visit https://groups.google.com/d/optout. > --=20 --=20 "Freedom is the only law".=20 "Freedom Unplugged" http://www.ilug-tvm.org You received this message because you are subscribed to the Google Groups "ilug-tvm" group. To control your subscription visit http://groups.google.co.in/group/ilug-tv= m/subscribe To post to this group, send email to ilug-tvm-/[email protected] To unsubscribe from this group, send email to ilug-tvm-unsubscribe-/[email protected] For details visit the google group page: http://groups.google.com/group/ilu= g-tvm?hl=3Den ---=20 You received this message because you are subscribed to the Google Groups "= Free Software Users Group, Thiruvananthapuram" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to ilug-tvm+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected] For more options, visit https://groups.google.com/d/optout. --001a114389d4209d64052c2de5ca Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:trebuche= t ms,sans-serif;font-size:small">Hello All,<br><br></div><div class=3D"gmai= l_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">th= anks you for suggestions and help.<br><br><blockquote style=3D"margin:0px 0= px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class= =3D"gmail_quote"> So, the first step is to disable php mail and use SMTP for all mails. Once mail is disabled, all requests to mail function can be logged as an error.<br></blockquote><br></div><div cl= ass=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-siz= e:small">@Manu, <br><br></div><div class=3D"gmail_default" style=3D"font-fa= mily:trebuchet ms,sans-serif;font-size:small">Is it possible to disable php= mail function to particular account. All of our projects are in our VPS bu= t there is one particular website is actually having this spamming problem.= <br><br></div><div class=3D"gmail_default" style=3D"font-family:trebuchet m= s,sans-serif;font-size:small">My doubt is if I disable this php mail functi= on, would not it disable mail functions in all other website projects resid= es in VPS=C2=A0 ? <br></div><div class=3D"gmail_default" style=3D"font-fami= ly:trebuchet ms,sans-serif;font-size:small">Is there any option to disable = php mail function to a particular website only in a VPS ?<br><br><br><br><b= r><blockquote>To find the spam mail source from you application. first chec= k the email content from the mail queue.<br>postcat -q queue ID.<br></block= quote></div><div class=3D"gmail_default" style=3D"font-family:trebuchet ms,= sans-serif;font-size:small"><br></div><div class=3D"gmail_default" style=3D= "font-family:trebuchet ms,sans-serif;font-size:small">@Kevin <br><br></div>= <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;f= ont-size:small">thanks for the suggestions. We have inspected for the spamm= ing php files and we have cleared it many times. But the issue is each time= we clear an infected php file, after one week or so, another new spamming = php is=C2=A0 being generated.<br><br></div><div class=3D"gmail_default" sty= le=3D"font-family:trebuchet ms,sans-serif;font-size:small">Is there any way= to fix this ? <br><br></div><div class=3D"gmail_default" style=3D"font-fam= ily:trebuchet ms,sans-serif;font-size:small">pls help, the issue is sever a= nd gmail already blacklisted our IP :( <br></div></div><div class=3D"gmail_= extra"><br clear=3D"all"><div><div class=3D"gmail_signature">**<br>Jai Bhim= <br>-- JeevZ --<br><br>*Jeevachaithanyan Sivanandan<br>+919446196667<br><a = href=3D"http://jeevanism.wordpress.com/" target=3D"_blank">http://jeevanism= .wordpress.com/</a><br>-- I Take Refuge On The Enlightened Wisdom --<br>-- = =E0=B4=AC=E0=B5=81=E0=B4=A6=E0=B5=8D=E0=B4=A7=E0=B4=82,=E0=B4=A7=E0=B5=BC= =E0=B4=AE=E0=B4=82, =E0=B4=B8=E0=B4=82=E0=B4=98=E0=B4=82=C2=A0 =E0=B4=B6=E0= =B4=B0=E0=B4=A3=E0=B4=82 =E0=B4=97=E0=B4=9A=E0=B5=8D=E0=B4=9B=E0=B4=BE=E0= =B4=AE=E0=B4=BF -- <br>*<br><br><br><br><br><br><br></div></div> <br><div class=3D"gmail_quote">On Thu, Feb 18, 2016 at 3:01 PM, kevin sha <= span dir=3D"ltr"><<a href=3D"mailto:[email protected]" target=3D"_bl= ank">[email protected]</a>></span> wrote:<br><blockquote class=3D"gm= ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le= ft:1ex"><div dir=3D"ltr"><div><div>Hi,<br><br></div>To find the spam mail s= ource from you application. first check the email content from the mail que= ue.<br></div><div>postcat -q queue ID.<br><br></div><div>check the origin s= ection, then you can see the location of php file.<br><br></div><div><div>o= r=C2=A0 <br><br></div><div>it is better to scan the application using malwa= re scanning tool like maldect. maldect is a good tool.<br></div><div><br></= div><div><br></div><div><div><a href=3D"https://www.rfxn.com/projects/linux= -malware-detect/" target=3D"_blank">https://www.rfxn.com/projects/linux-mal= ware-detect/</a><br><a href=3D"http://www.woktron.com/secure/knowledgebase/= 145/Installation-Linux-Malware-Detect-Maldet-On-CentOS.html" target=3D"_bla= nk">http://www.woktron.com/secure/knowledgebase/145/Installation-Linux-Malw= are-Detect-Maldet-On-CentOS.html</a><br><a href=3D"http://www.2daygeek.com/= install-linux-malware-detect-lmd-on-ubuntu-centos-debian-fedora-mint-rhel-o= pensuse/#" target=3D"_blank">http://www.2daygeek.com/install-linux-malware-= detect-lmd-on-ubuntu-centos-debian-fedora-mint-rhel-opensuse/#</a><br><br><= br></div><div>Thank you<br></div><div><br></div></div></div></div><div clas= s=3D"gmail_extra"><br><div class=3D"gmail_quote"><div><div class=3D"h5">On = Wed, Feb 17, 2016 at 10:24 AM, JeevZ <span dir=3D"ltr"><<a href=3D"mailt= o:[email protected]" target=3D"_blank">[email protected]</a>></span>= wrote:<br></div></div><blockquote class=3D"gmail_quote" style=3D"margin:0 = 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class=3D"h5= "><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:trebuc= het ms,sans-serif;font-size:small">Hello,<br><br></div><div class=3D"gmail_= default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">This= is an offtopic, a help seeking message. <br><br></div><div class=3D"gmail_= default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">We h= ave done a project on OpenCart which is residing in our VPS. Somehowm one m= alicious script is creating Spam Emails. We have found out that php file an= d cleared it. But this repeats again and dynamically such spam sending scri= pts are being generated. This makes entire vps server fail and other seriou= s problems. <br><br></div><div class=3D"gmail_default" style=3D"font-family= :trebuchet ms,sans-serif;font-size:small">We have inspected for base64 encr= yption and other normal method find such malicious code but none to find. W= e have changed=C2=A0 passwords several times but still the issue persists.<= br><br><br></div><div class=3D"gmail_default" style=3D"font-family:trebuche= t ms,sans-serif;font-size:small">Is there any one here who has some experie= nce on this ? the problem is we cannot locate which files creates spam send= ing scripts dynamically. <br><br><br></div><div class=3D"gmail_default" sty= le=3D"font-family:trebuchet ms,sans-serif;font-size:small">please help<br><= br><br></div><div class=3D"gmail_default" style=3D"font-family:trebuchet ms= ,sans-serif;font-size:small">thank you <br></div><div class=3D"gmail_defaul= t" style=3D"font-family:trebuchet ms,sans-serif;font-size:small"><br><br cl= ear=3D"all"></div><div><div>**<br>Jai Bhim<br>-- JeevZ --<br><br>*Jeevachai= thanyan Sivanandan<br><a href=3D"tel:%2B919446196667" value=3D"+91944619666= 7" target=3D"_blank">+919446196667</a><br><a href=3D"http://jeevanism.wordp= ress.com/" target=3D"_blank">http://jeevanism.wordpress.com/</a><br>-- I Ta= ke Refuge On The Enlightened Wisdom --<br>-- =E0=B4=AC=E0=B5=81=E0=B4=A6=E0= =B5=8D=E0=B4=A7=E0=B4=82,=E0=B4=A7=E0=B5=BC=E0=B4=AE=E0=B4=82, =E0=B4=B8=E0= =B4=82=E0=B4=98=E0=B4=82=C2=A0 =E0=B4=B6=E0=B4=B0=E0=B4=A3=E0=B4=82 =E0=B4= =97=E0=B4=9A=E0=B5=8D=E0=B4=9B=E0=B4=BE=E0=B4=AE=E0=B4=BF -- <br>*<br><br><= br><br><br><br><br></div></div> </div><div><br> <table style=3D"border-top:1px solid #aaabb6"> <tbody><tr> <td style=3D"width:470px;padding-top:20px;color:#41424e;font-size:13px;fo= nt-family:Arial,Helvetica,sans-serif;line-height:18px">This email has been = sent from a virus-free computer protected by Avast. <br><a href=3D"https://= www.avast.com/sig-email" style=3D"color:#4453ea" target=3D"_blank">www.avas= t.com</a> </td> </tr> </tbody></table><a href=3D"#601046615_-1023183722_DDB4FAA8-2DD7-40BB-A1B8-4= E2AA1F9FDF2" width=3D"1" height=3D"1"></a></div> <p></p></div></div> -- <br><div><div class=3D"h5"> -- <br> "Freedom is the only law". <br> "Freedom Unplugged"<br> <a href=3D"http://www.ilug-tvm.org" target=3D"_blank">http://www.ilug-tvm.o= rg</a><br> =C2=A0<br> You received this message because you are subscribed to the Google<br> Groups "ilug-tvm" group.<br> To control your subscription visit <a href=3D"http://groups.google.co.in/gr= oup/ilug-tvm/subscribe" target=3D"_blank">http://groups.google.co.in/group/= ilug-tvm/subscribe</a><br> To post to this group, send email to <a href=3D"mailto:ilug-tvm@googlegroup= s.com" target=3D"_blank">ilug-tvm-/[email protected]</a><br> To unsubscribe from this group, send email to<br> <a href=3D"mailto:ilug-tvm-unsubscribe-/[email protected]" target=3D"_blank">= ilug-tvm-unsubscribe-/[email protected]</a><br> =C2=A0<br> =C2=A0<br> =C2=A0<br> For details visit the google group page: <a href=3D"http://groups.google.co= m/group/ilug-tvm?hl=3Den" target=3D"_blank">http://groups.google.com/group/= ilug-tvm?hl=3Den</a><br> <br> --- <br> You received this message because you are subscribed to the Google Groups &= quot;Free Software Users Group, Thiruvananthapuram" group.<br> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:ilug-tvm+unsubscribe-/[email protected]" target=3D"= _blank">ilug-tvm+unsubscribe-/[email protected]</a>.<br> For more options, visit <a href=3D"https://groups.google.com/d/optout" targ= et=3D"_blank">https://groups.google.com/d/optout</a>.<br> </div></div></blockquote></div><br></div><div class=3D"HOEnZb"><div class= =3D"h5"> <p></p> -- <br> -- <br> "Freedom is the only law". <br> "Freedom Unplugged"<br> <a href=3D"http://www.ilug-tvm.org" target=3D"_blank">http://www.ilug-tvm.o= rg</a><br> =C2=A0<br> You received this message because you are subscribed to the Google<br> Groups "ilug-tvm" group.<br> To control your subscription visit <a href=3D"http://groups.google.co.in/gr= oup/ilug-tvm/subscribe" target=3D"_blank">http://groups.google.co.in/group/= ilug-tvm/subscribe</a><br> To post to this group, send email to <a href=3D"mailto:ilug-tvm@googlegroup= s.com" target=3D"_blank">ilug-tvm-/[email protected]</a><br> To unsubscribe from this group, send email to<br> <a href=3D"mailto:ilug-tvm-unsubscribe-/[email protected]" target=3D"_blank">= ilug-tvm-unsubscribe-/[email protected]</a><br> =C2=A0<br> =C2=A0<br> =C2=A0<br> For details visit the google group page: <a href=3D"http://groups.google.co= m/group/ilug-tvm?hl=3Den" target=3D"_blank">http://groups.google.com/group/= ilug-tvm?hl=3Den</a><br> <br> --- <br> You received this message because you are subscribed to the Google Groups &= quot;Free Software Users Group, Thiruvananthapuram" group.<br> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:ilug-tvm+unsubscribe-/[email protected]" target=3D"= _blank">ilug-tvm+unsubscribe-/[email protected]</a>.<br> For more options, visit <a href=3D"https://groups.google.com/d/optout" targ= et=3D"_blank">https://groups.google.com/d/optout</a>.<br> </div></div></blockquote></div><br></div> <p></p> -- <br /> -- <br /> "Freedom is the only law". <br /> "Freedom Unplugged"<br /> <a href=3D"http://www.ilug-tvm.org">http://www.ilug-tvm.org</a><br /> <br /> You received this message because you are subscribed to the Google<br /> Groups "ilug-tvm" group.<br /> To control your subscription visit <a href=3D"http://groups.google.co.in/gr= oup/ilug-tvm/subscribe">http://groups.google.co.in/group/ilug-tvm/subscribe= </a><br /> To post to this group, send email to ilug-tvm-/[email protected]<br /> To unsubscribe from this group, send email to<br /> ilug-tvm-unsubscribe-/[email protected]<br /> <br /> <br /> <br /> For details visit the google group page: <a href=3D"http://groups.google.co= m/group/ilug-tvm?hl=3Den">http://groups.google.com/group/ilug-tvm?hl=3Den</= a><br /> <br /> --- <br /> You received this message because you are subscribed to the Google Groups &= quot;Free Software Users Group, Thiruvananthapuram" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:ilug-tvm+unsubscribe-/[email protected]">ilug-tvm+u= nsubscribe-/[email protected]</a>.<br /> For more options, visit <a href=3D"https://groups.google.com/d/optout">http= s://groups.google.com/d/optout</a>.<br /> --001a114389d4209d64052c2de5ca--