Find which PHP script is sending spam emails

You have a WordPress blog that has been compromised or hacked. Some script on the server is sending spam emails and you do know which one. Try the following steps to find and remove the bad script.

1. Create a file called phpmail.log

touch /var/log/phpmail.log

2. Change permissions on the file so that the web server can write to it. This can be done in many ways.

chown httpd:httpd /var/log/phpmail.log


chmod 777 /var/log/phpmail.log

3. Locate your php.ini file (in case of RHEL, CenOS and SuSE, it will here: /etc/php.ini). Edit/add the following two lines are in file

mail.add_x_header = On
mail.log = /var/log/phpmail.log

4. Restart your web server

service httpd restart

5. Now tail the log file…

tail -f /var/log/phpmail.log

When an email is sent from a PHP script you will see an entry in the log that looks like this…

mail() on [/var/www/html/site2/wp-content/plugins/wp-image-hover-lite/admin/functions.php(1967) : eval()’d code:775]: To: — Headers: Date: Mon, 26 Dec 2016 06:55:17 +0000 From: Joe Smith <> Message-ID: <> X-Priority: 3 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=”b1_5cd2be098536da5aefaba80101b8a1a3″ Content-Transfer-Encoding: 8bit

In this case the offending script can be seen in bold above. Check out this script and delete it if it looks suspicious.


3 thoughts on “Find which PHP script is sending spam emails

  1. There is no need to wait for anything if youu hace a passion to start your business.Carrying bbad credit
    would not waste your ttime and it would also not impose any additional miserable condition on you in solving the purpose.
    There is one and only deal of badd credit business loans that support
    you in doing what you are xactly dreaming now. Thse loans are
    given to any UK citizen at low interest rate and one can make any usage of this amount.
    Make no stress on your mind as it is available as secured and unsecured form and everyone has full freedom to use it.

    The Tory-led coalition is still continuing on thee
    path of austerity, despite no improvement in inflation or employment.
    Thhe OECD has warned that the coalition is cuttig too fast and too deep, and
    will risk the fragile recovery, and could lead to a double-dip recession. Growth for the UK has been downgraded to only 1.4% for this year.The Bank of England MPC will
    maintain the interest rate at thhe record low of 0.5%, to combat inflation.

    Web & Programming – Getting a website up and running iss
    one thing. Keeping it updated as the web evolves and internet marketing changes is
    another. Get good, experienced here help. These winners
    can ggrow your business sitge for you, adding a blog, a forum, a classified ad area, a photo gallery and much more.

    To do that, simply divide your total estimated closing costs by how much you save per month on your mortgage.
    The number you get will be exactly the number of months it will take you
    to recover your closing costs! Then ask yourself if you’ll still be in the home aftrer all those months…
    or did yoou pla on moving to a new home?

    When thhe furnace is noot oon or the airr conditioner not operated, the hoe is adversely affected.

    When a property is vacant thede are no humans to scare off pests or keep the pipes running.

    No one has been raking, shoveling orr mowing. Why these possibilities alon are enougth to
    bring down the price of a home, they are just the beginning.

    Thhe final man, John McCluskey is still on the run. McCluskey, who is traveling with his
    cousin and finance Cassly Welch waas serving a life sentence.
    Police now believe that McCluskey will go as far as committing suicide
    to keep from being caught.

    Finding time to blog is one of the basic problems blogger face these days, especially if the blogger is managing sedveral blogs
    at a time or managing an event or entertainment blog.It could
    be tedious sometimes for you to stay up to date with what
    is happening in othr to kknow what to write for your readers.If you have severa blogs you manage
    at a time, writing and scheduling ylur blog post could be helpful.

    For myself, a man whoo was oonce described a beig to
    the right of Barry Goldwater, my support of McCain hasn’t bee shaken by this
    allegation of a relationship with Vicki Iseman. Readung the
    Neew York Times article, all I can see is hints, nothing concrete.
    It is the time iin campaigns when things, true or untrue, come out of tthe woodwork.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s