How to find the script on Plesk server that is sending SPAM as www-data user

I am running a Plesk 9.0.1 Web Server on Ubuntu 6.06.2 LTS and have about 100 small to medium web sites hosted on the server. The problem is that I believe one of the websites has a script that is allowing spam to be sent through the server. The reason I believe this is that I get 1000s of messages an our deferred in the mail queue that show to be sent from the www-data user.

My question is if someone can tell me how to find the script or scripts that is sending the SPAM?

Thanks in advance for your help.
mcmincAsked:
Who is Participating?
 
rackaid2Commented:
Take a look at the Plesk KB article:
http://kb.parallels.com/en/766

You will need to determine where the spam is originating. If it is a user, then frequent SMTP access can often pinpoint the user.  

If is a web script, then you will see emails coming from the nobody user and you can use this technique:
http://kb.parallels.com/en/1711
0
 
Kamran ArshadIT AssociateCommented:
Hi,

Is it a windows or Linux box?
0
 
mcmincAuthor Commented:
It is a Linux Ubuntu 6.06.2 LTS machine
0
 
mcmincAuthor Commented:
Does anyone have any ideas on what I can try?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.