I'm a VPS account owner and i'm getting emails all the time saying i'm out of memory.

the hosting company don't seem to want to solve the problem, instead they want to try sell me another service without fixing the current problem. ( moving emails to a new service and turning off all mail fuctions )

They are saying a spamming script was installed via wordpress vulnerability. But don't know where or when or what it is. But I don't expect them to know that.

I've removed about 90% of the websites from the server and not there is only 3-4 websites running wordpress ( i'll be removing another one soon )

I've deleted over 20 wordpress installs.

But still the server is running our or memory.

The host says it's a script sending emails. My ip address has been placed on some black lists.

I've used a little linux in the past but very basic.

Does anyone know:

1: Can i find the location of the files sending these spam mails 2: Can i limit the number of emails sent on the server per user ? There is myself and 2 others that would only use the emails and i know they are not spamming.. they only send 2-3 emails per day.

Is there any other suggestions on what I could do ? Thanks

closed as too broad by Rui F Ribeiro, dr01, countermode, ilkkachu, GAD3R Apr 19 '17 at 13:27

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You are a customer, press them to solver your problem. It is unrealistic to expect support from other people without being able to dig more details on yourself ; if they are not able to uphold their part of the service, change to another service. – Rui F Ribeiro Apr 19 '17 at 7:59
  • @RuiFRibeiro That's not a realistic expectation. The hosting providers I have used give you bandwidth, backups, and a machine, but from there on you're SOL. And they are probably losing money right now from protecting their other customers from the fallout from your gaffe. If you are lucky they can offer competent (i.e. not cheap) paid support. – tripleee Apr 20 '17 at 0:57
  • If they sold you managed WordPress hosting and their WordPress turned out to be poorly secured, that's of course a different matter. – tripleee Apr 20 '17 at 1:09
  • @tripleee It is a far less realistic expectation to come here asking for technical assistance without having the slightest notion of what is happening and being unable to verbalize it; those kind of people should hire a sysadmin freelancer imo. I would argue the spirit of this forum is giving an helping hand in some details they are lacking, and not writing tutorials, or guiding people step from step from the very very basics. I equate those posts going to WebMd and asking: I have opened the belly of a patient, but I have no idea what to do next...what tools and medication should I use? – Rui F Ribeiro Apr 20 '17 at 8:01
  • No argument there. I just commented on the "if they are not able to uphold their part of the service" where, on closer reading, I'm not sure you are actually referring to the VPS provider. – tripleee Apr 20 '17 at 8:08

Replace the hacked Wordpress instances with known-good backups.

What, you don't have backups? Then it's harder. My suggestion would be to shut down them all, then enable one at a time until you see the spew start again, then shut that down again and focus your investigations on what exactly is wrong there.

https://codex.wordpress.org/FAQ_My_site_was_hacked lists some resources you can use for determining what exactly seems to be causing the problem. You have access to your site's internals and they don't, so they can probably only vaguely nudge you in the right direction; but if that helps, be grateful.

You are focusing entirely on the wrong factors here. Your hacked site is causing problems for the neighborhood. You need to stop that. Whether your NSP wants to charge you for support or damages is completely tangential here. The email alerts you receive are also just a vague symptom of the much more severe problems you are currently causing in other people's inboxes.

If you do have backups but don't know how far back in time to go, various blocklists etc are a good source for establishing an approximate timeline. Google blacklisted you on April 2nd? Then look around that date for weird changes in your backups. Do keep in mind that many break-ins happen in stages, and the initial backdoor could have been installed significantly earlier. For a run of the mill hack, though, the perp probably found and exploited a vulnerability in one fell swoop, and proceeded to install a smattering of drive-by downloads, spam scripts, additional backdoors, and a kitchen sink.

In concrete terms, look for PHP or JavaScript code added to the WordPress files themselves. There are many ways to hide and obfuscate code, but if you just run the standard install from your VPS provider, it should not be hard to find where yours differs from theirs. If you have identical code duplicated for many sites, a simple diff -urNad site1 site2 | less will tell you what the differences are. It's also possible that some or all of the malicious content is in the content database, so you'll need to vet that too.

  • Hi, thanks for your reply. - What is NSP ? - I do have backups, But don't know which site is causing the issue. Does it have to be a wordpress site that causes this ? or can they install scripts in a random folder and still send emails ? - Is there an easy way to turn off all sites and put them back on one at a time. – idontknowjs Apr 19 '17 at 7:39
  • Network Service Provider, aka VPS provider. – tripleee Apr 19 '17 at 7:43
  • Wordpress is a common popular target and that's what you mentioned in your question. Anything else which runs code is vulnerable, especially if you created it yourself or otherwise run code which has not been thoroughly audited. – tripleee Apr 19 '17 at 7:44
  • As for how to disable your sites, there are a number of mechanisms in use at different VPS providers; consult the documentation for yours. – tripleee Apr 19 '17 at 7:44
  • Updated with a bit about establishing a timeline for what to restore from backups. – tripleee Apr 19 '17 at 7:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.