Server sending spam: How to troubleshoot?

katydid

Registered
Jun 29, 2011
1
0
51
My server is sending out spam messages, and I don't even know where to start to troubleshoot this. What can I look for? Here's an example. It's obviously being sent out by some PHP script ("nobody"), but X-Source* are blank. I cannot globally disable PHP mail, and I can't turn on phpsuexec because it breaks a bunch of the scripts. How can I track these to a script on my server?

Code:
Received: from server.example.com (server.example.com [123.123.123.123])
by mtain-dh05.r1000.mx.aol.com (Internet Inbound) with ESMTP id 9BB36380002A1
for <[email protected]>; Tue, 28 Jun 2011 13:59:37 -0400 (EDT)
Received: from nobody by server.example.com with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1QbcLv-0004nn-S3
for [email protected]; Tue, 28 Jun 2011 12:45:35 -0500
To: [email protected]
Subject: PLS HELP ME
From: WILLIAMS <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Tue, 28 Jun 2011 12:45:35 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.example.com
X-AntiAbuse: Original Domain - aol.com
X-AntiAbuse: Originator/Caller UID/GID - [99 500] / [47 12]
X-AntiAbuse: Sender Address Domain - server.example.com
X-Source:
X-Source-Args:
X-Source-Dir:
x-aol-global-disposition: S
X-AOL-SCOLL-SCORE: 0:2:107005616:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d41194e0a16895298
X-AOL-IP: 123.123.123.123
X-AOL-SPF: domain : server.example.com SPF : none
MIME element (text/plain)
ENGR WILLIMAS
FEDERAL MINISTRY OF
PETROLEUM AND MINERAL
RESOURCES.
FEDERAL REPUBLIC OF NIGERIA,
LAGOS, NIGERIA
WEST AFRICA.
ATTN:Sir
PLEASE REPLY to:(
Dear Friend,
RE:REQUEST FOR URGENT CONFIDENTIAL BUSINESS RELATIONSHIP IN RESPECT OF THE
TRANSFER OF $25,500,000.00(TWENTY-FIVE MILLION FIVE HUNDRED AMERICAN
DOLLARS)INTO YOUR ACCOUNT.
I,on behalf of my other colleagues from different Federal Government of
Nigeria owned parastatals decided to solicit your assistance as regards
the transfer of the above stated amount into your bank account. This fund
arose from the over invoicing of various contracts awarded in my
parastatal to certain foreign contractors sometime ago.
We as holders of sensitive positions in our various parastatal, were
mandated by the federal government to scrutinise all payments made to
foreign contractors,
and discovered that some of the contracts they executed were grossly over
invoiced,either by omission or commission. Also, we discovered that the
sum of $33,000,000.00(thirty three million American dollars only) was
lying in a suspense account, although the foreign contractors were fully
paid their entitlements after executing the said contracts.
We all agreed that the over-invoiced amount be transferred into a bank
account provided by a foreign partner, as the code of conduct of federal
civil service does not allow us to operate foreign accounts.
However, we have suceeded in transferring some of the monies, precisely
US$7.5(Seven million five Hundred American Dollars) into a foreign account
in united State of America,but unfortunately the provider of the account
has severed all forms of communication with us as he has refused to adhere
to our earlier mutual agreement, insisting that the total amount be paid
into his nominated bank account beforedisbursement will take effect.
We are therefore seeking your assistance based on the balance amount
US$25.5M which can be speedily processed and fully remitted into your
nominated bank account.On successful remittance of the funds into your
account, you will be compensated with 20% of of the amount for your
assistance and services.
This transaction is closely knitted and in view of our sensitive positions
we cannot afford a slip. I assure you that this transaction is 100% risk
free.
We will avail you with our identities as regards our respective office
when relationship is fully established and smooth operation commences.
I am at your disposition to entertain any questions from you in respect of
this transaction, so, contact me immediately through the above email
address for further information on the requirements and procedure.
Please note that this is a DEAL and confidentiality is of very great
important for security reasons.
Please treat with strict confidential and utmost urgency.
N.B: Your telephone and fax numbers are needed for easy communication.
Best regards,
CIVIL SERVANT
FEDERAL MINISTRY OF
PETROLEUM AND MINERAL
RESOURCES
ENGR WILLIMAS