1

This question already has an answer here:

I am running Ubuntu 14.04.3 with apache2, postfix and dovecot. Today (about 24 hours ago) my server started sending spam (like 10-20 mails to random addresses every 2-3 minutes) and I got blacklisted. Postfix is using authentication. After investigating, analyzing the logs and such, I found a suspicious file, which I erased, inside a wordpress installation. These were the contents:

$auth_pass = "63a9f0ea7bb98050796b649e85481845";
$color = "#df5";
$default_action = 'FilesMan';
$default_use_ajax = true;
$default_charset = 'Windows-1251';
$xYEzDu6r3EZT="very long string here"));                                                                            

An unix user also had this in the crontab

* * * * * /tmp/ /.random/update >/dev/null 2>&1

I also removed this from the crontab

The server keeps on spamming, as I can see periodically from lsof and mail.log. I stopped apache2, to be sure it's not a php script called from the outside. Nothing again.

Next step was stopping port 25 and 465 from listening from inside /etc/postfix/master.cf. Again, it keeps on spamming. I even tried stopping the unix port from listening, and it keeps on trying sending spam and I get lines like this:

Oct  2 02:52:46 ubuntu postfix/error[4709]: 0D7703622121: to=<polisenos@bellsouth.net>, relay=none, delay=49829, delays=49829/0/0/0, dsn=4.3.0, status=deferred (mail transport unavailable)

The server has been marked as spammer in spamhaus and emails coming from it are refused from most servers. /tmp and /var/tmp are empty, maldet, chkrootkit and rkhunter can't find anything. I've checked auth.log and nobody got in besides me. Looks like there's a malware/daemon/process calling postfix every 2-3 minutes, but I really can't find it. I'm clueless. It's a production server and I'm big trouble, hope somebody can help. Thanks

marked as duplicate by Gilles linux Oct 2 '15 at 22:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.