asked on

Scan for malicious code on server

Hi ,one of the users on our server is sending spam from our server thru php or cgi script.
Because in our log it only shows that apache has sent an email.

How can I find out which user is sending it or is there some programs or scripts that will allow me to scan for malicious mail sending scirpts?

Thanks

webtrans

first u have to find out which script is sending the email
then check the log for which ip is requesting this folder
?

basara55

ASKER

Well yes thats the problem I am having , How can I find out there is trizillion scripts and users on the server.

webtrans

what server side scripting language are avilable on the server?

basara55

ASKER

php , jsp , cgi (perl)

ASKER CERTIFIED SOLUTION

webtrans

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

owensleftfoot

The apache logfile in /var/log will show you which user accessed what by their ip addresses.

SOLUTION

_GeG_

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

ahoffmann

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

_GeG_

> This question has been classified as abandoned because there are no comments in the last 21 days.
lol, last post from May 2004

BTW I think my answer provided a usable solution....

Venabili

>>lol, last post from May 2004
Well... it is at least 2004 :)) Not older :)

ahoffmann

> BTW I think my answer provided a usable solution....
so I do ...