Has my vB forum been hacked?

[hawork]

I do think that my vBulletin forum has been hacked. My server provider has told me that many of my users are receiving spam mails (Viagra, cialis,etc) and of course I’m not sending that kind of mails. ¿Is it possible that someone is using my users’s e-mail addresses to send these mails from my server? If the answer is yes, I would be very pleased if someone could help me to fix it. The first thing I’ve done is updating my forum to the last version but I still have the same problem.



I’ve closed almost all of my server ports with iptables (I think I’ve done it right). But I’m receiving the same mails from my server provider with my log’s extracts. The mails are been sent through port 25 and I’ve closed it (at least that is what I see when I list my iptables with iptables –L).



I’ve heard that it is possible that a bot had left some code in a vB php file and it’s running all the time but if I look at the processes that are running I can see nothing strange. Some processes from nobody but seems to be apache stuff. If I only could find that code (or php file)?



If someone could tell me anything I’d be very pleased.



Thanks in advance,

[snakes1100]

There is no easy way for us to tell how the emails are being sent, wether its thru the forums or the server has actually been breached.

For the most part, you need to check everything, ranging from what every pid/process is & what its doing, to tracking the emails thru the log to find out where its coming from.

[hawork]

Yes, I know it's very difficult to know. But the thing is that I cannot understand why is that 'bot' sending mails through port 25 if I've just closed it. I thought that a closed port could not work.

any idea?