How can I find a hacked file in VB

[Scalemotorcars]

So I just installed the Bounced Email handler for VB4 and im getting some strange bounces that have me concerned that someone may be using my hosting to send out spam emails.

I did a Suspect File search and got about 150 files that are not stock VB. Now I do have about 30+ mods installed so thats normal but how do I find a hacked file that may be sending out these spam emails in all those files? And I have no ideal how long they have been doing this and my oldest backup of the files is only about 6 months. But that still will not fix any added files. Also have no ideal how to search the DB for anything embed.

Anyway is theres something Im not looking at or is it just a matter of going over each file manually?

Is there a way to search the DB for what may be causing this?

Thanks for your time...
Daniel

[Dave]

Well if if you think a script is sending spam on your machine, you could search for the mail function in PHP to find the culprit like so on Linux:

grep -Ril "mail(" /directory/of/htdocs/

That will list all files which contain "mail(".

[RichieBoy67]

You can also download the files and then do a text search in all the files using notepadd++...

If you thin you are hacked you can search for debase64 in the files and any of the non vbulletin files you can take a closer look at. Just because some may have it doesn't neccesarily mean they are hacked but it will help you narror things down.

Chances are though if your site is sending out emails it is your server and not your site. Perhaps someone has gotten your smtp passwords. Make sure you have relaying closed or authorization required.

[Brandon Sheley]

Someone can easily compromised an email form without "hacking" the site as well. It doesn't even have to be from your forum. Do you host other sites or scripts other then your forum? Are you on a dedicated server, if it's shared or a vps they could abuse your site well outside your forum as well.

Good luck

[Scalemotorcars]

Originally Posted by Dave

Well if if you think a script is sending spam on your machine, you could search for the mail function in PHP to find the culprit like so on Linux:

grep -Ril "mail(" /directory/of/htdocs/

That will list all files which contain "mail(".

Would I run this in PHPmyAdmin as a query?

[Brandon Sheley]

Originally Posted by Scalemotorcars

Would I run this in PHPmyAdmin as a query?

I don't know the command but it looks like it would be from a terminal, like a SSH connection with PuTTY.

[Dave]

Originally Posted by Scalemotorcars

Would I run this in PHPmyAdmin as a query?

No, that command has nothing to do with MySQL databases. It's a command you execute through SSH in the terminal.

[Scalemotorcars]

Originally Posted by Brandon Sheley

Someone can easily compromised an email form without "hacking" the site as well. It doesn't even have to be from your forum. Do you host other sites or scripts other then your forum? Are you on a dedicated server, if it's shared or a vps they could abuse your site well outside your forum as well.

Good luck

I figured it was from the forum since the only place that has the Bounce return email address is on my site. All the bounce settings on hosted on VB so wouldn't that make it a corrupt file?

--------------- Added [DATE]1458566796[/DATE] at [TIME]1458566796[/TIME] ---------------

Originally Posted by Dave

No, that command has nothing to do with MySQL databases. It's a command you execute through SSH in the terminal.

You lost me. Can I do it from my C Panel on the host?

[Dave]

Are you on shared hosting? 99.9% of the time shared hosts do not give you access to SSH, it will not be possible to execute the command in that case.

[Scalemotorcars]

@Dave

Yes its shared. I'm beginning to think I need a dedicated server but thats crazy expensive. Any suggestions on something reasonable?