help a script is sending my user passwords to an email

[msimen]

hello please can you help me to solve this problem ,i found many emails queued on my server when i stopped postfix ,the emails contains username and correct password of many logged in users , i cleaned many files , but the emails still sending ,i don't know where is the script and how to stop it plz help

[SVTCobraLTD]

Disable your products and contact vB support.

[msimen]

i disabled all products and cleaned all garbage ,still the same problem

[snakes1100]

ps ax | more

check what processes are running, anything typical like ./name kill it, find the scripts on the server and remove them, my guess is your already to late anyways and your server is probably compromised, i would shut the forum down as well as kill apache/php, as well as postfix.

upgrade your server backend as well.

[TNCclubman]

arent the passwords encrypted? Theyre not stored in their native text anywhere, even in the database

[snakes1100]

@tnc, that is true, but that is changable.

[msimen]

yes the passwords and the username are clear not encrypted , here is an exemple

From www-data@host.xxxxx.com (www-data)
To xxxxxx@windowslive.com
Date Fri, 6 Nov 2009 20:02:49 +0100 (CET)
Subject Victim

username: username
Password: clear password



########

i found a fil in avatars named avatar662.php and the code is crypted there

and other fil on the attachments ,but not sure if it's

here is the text

-- the 'correct' password
real_password = "password";

-- prompt the user to enter a password
user_password = Dialog.PasswordInput("Password", "Please enter the password: ", MB_ICONQUESTION);

-- compare the user's password to the 'correct' password.
-- If the user supplies the wrong password, exit the program.
if real_password ~= user_password then
Application.Exit();
end

[TNCclubman]

what mods do you have installed?

[msimen]

i removed all mods ,still the same problem where is the script sending that !!

[TNCclubman]

what were the mods. The fact you removed them means nothing if thats how they got in.