My server is sending out spam messages, and I don't even know where to start to troubleshoot this. What can I look for? Here's an example. It's obviously being sent out by some PHP script ("nobody"), but X-Source* are blank. I cannot globally disable PHP mail, and I can't turn on phpsuexec because it breaks a bunch of the scripts. How can I track these to a script on my server?
Received: from server.example.com (server.example.com [220.127.116.11]) by mtain-dh05.r1000.mx.aol.com (Internet Inbound) with ESMTP id 9BB36380002A1 for <[email protected]>; Tue, 28 Jun 2011 13:59:37 -0400 (EDT) Received: from nobody by server.example.com with local (Exim 4.69) (envelope-from <[email protected]>) id 1QbcLv-0004nn-S3 for [email protected]; Tue, 28 Jun 2011 12:45:35 -0500 To: [email protected] Subject: PLS HELP ME From: WILLIAMS <[email protected]> Reply-To: [email protected] MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 8bit Message-Id: <[email protected]> Date: Tue, 28 Jun 2011 12:45:35 -0500 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server.example.com X-AntiAbuse: Original Domain - aol.com X-AntiAbuse: Originator/Caller UID/GID - [99 500] / [47 12] X-AntiAbuse: Sender Address Domain - server.example.com X-Source: X-Source-Args: X-Source-Dir: x-aol-global-disposition: S X-AOL-SCOLL-SCORE: 0:2:107005616:93952408 X-AOL-SCOLL-URL_COUNT: 0 X-AOL-REROUTE: YES x-aol-sid: 3039ac1d41194e0a16895298 X-AOL-IP: 18.104.22.168 X-AOL-SPF: domain : server.example.com SPF : none MIME element (text/plain) ENGR WILLIMAS FEDERAL MINISTRY OF PETROLEUM AND MINERAL RESOURCES. FEDERAL REPUBLIC OF NIGERIA, LAGOS, NIGERIA WEST AFRICA. ATTN:Sir PLEASE REPLY to:( Dear Friend, RE:REQUEST FOR URGENT CONFIDENTIAL BUSINESS RELATIONSHIP IN RESPECT OF THE TRANSFER OF $25,500,000.00(TWENTY-FIVE MILLION FIVE HUNDRED AMERICAN DOLLARS)INTO YOUR ACCOUNT. I,on behalf of my other colleagues from different Federal Government of Nigeria owned parastatals decided to solicit your assistance as regards the transfer of the above stated amount into your bank account. This fund arose from the over invoicing of various contracts awarded in my parastatal to certain foreign contractors sometime ago. We as holders of sensitive positions in our various parastatal, were mandated by the federal government to scrutinise all payments made to foreign contractors, and discovered that some of the contracts they executed were grossly over invoiced,either by omission or commission. Also, we discovered that the sum of $33,000,000.00(thirty three million American dollars only) was lying in a suspense account, although the foreign contractors were fully paid their entitlements after executing the said contracts. We all agreed that the over-invoiced amount be transferred into a bank account provided by a foreign partner, as the code of conduct of federal civil service does not allow us to operate foreign accounts. However, we have suceeded in transferring some of the monies, precisely US$7.5(Seven million five Hundred American Dollars) into a foreign account in united State of America,but unfortunately the provider of the account has severed all forms of communication with us as he has refused to adhere to our earlier mutual agreement, insisting that the total amount be paid into his nominated bank account beforedisbursement will take effect. We are therefore seeking your assistance based on the balance amount US$25.5M which can be speedily processed and fully remitted into your nominated bank account.On successful remittance of the funds into your account, you will be compensated with 20% of of the amount for your assistance and services. This transaction is closely knitted and in view of our sensitive positions we cannot afford a slip. I assure you that this transaction is 100% risk free. We will avail you with our identities as regards our respective office when relationship is fully established and smooth operation commences. I am at your disposition to entertain any questions from you in respect of this transaction, so, contact me immediately through the above email address for further information on the requirements and procedure. Please note that this is a DEAL and confidentiality is of very great important for security reasons. Please treat with strict confidential and utmost urgency. N.B: Your telephone and fax numbers are needed for easy communication. Best regards, CIVIL SERVANT FEDERAL MINISTRY OF PETROLEUM AND MINERAL RESOURCES ENGR WILLIMAS