unknown spam source

Dear all,

My server has been generating spam emails since last 3 days and could not trace out the source. I found similar case here: http://forums.cpanel.net/f43/open-relay-server-284991.html as well.

Followings are the things I have already done without any success:

1. checked for culprit php script by making new phpmail.log (seems like it is not php script)
2. malware cleaned
3. shutdown joomla site
4. shutdown moodle site
5. shutdown old lime survey site

Any advice, suggestion - how can the culprit be tracked?

Best regards, Deependra

 

spam emails

My dedicated server is generating spam emails continuously. it does not seem to be from php script. Is there anyway to track the culprit, i have been trying to find out since last one week. It generates more than 2o emails a second - please help.

Best regards, Deependra

 

Because of the last amount of email, the server blocked the out going email - that is when i came to know about it. I am copying here one of the mails in queue:

Code:

Mail Control Data:
icimod 510 500
<icimod@server.domain.org>
1398777168 0
-ident icimod
-received_protocol local
-body_linecount 3
-max_received_linelength 28
-auth_id icimod
-auth_sender icimod@server.domain.org
-allow_unqualified_recipient
-allow_unqualified_sender
-local
XX
1
someuser@hotmail.com

Date:
Tue, 29 Apr 2014 18:57:48 +0545
From:
root@localhost
To:
someuser@hotmail.com
Subject:
Test mail 405209145
Message-Id:
<E1Wf7q4-0004qQ-0n@server.domain.org>
Received:
from domain by server.domain.org with local (Exim 4.82)
(envelope-from <icimod@server.domain.org>)
id 1Wf7q4-0004qQ-0n
for someuser@hotmail.com; Tue, 29 Apr 2014 18:57:48 +0545
Sender:
<icimod@server.domain.org>

Bla-bla-bla
----------------
best regards

 

But this is not the solution or finding out the root of problem. I will try this too. Could this be the cpanel bug or loophole?

 

sending email by root is already blocked. Any other suggestions?

 

yes, icimod is the main account. Password has been changed several times. Okay let me search for spam source in the forum - if any suggestion, I am glad to take on.

Best regards,