logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> Other Software View previous topic :: View next topic
Reply to topic   Topic: tracking down php script sending spam
Author
Qwazi



Joined: 28 Mar 2016
Posts: 2
Location: Maui

PostPosted: Tue 29 Mar '16 4:47    Post subject: tracking down php script sending spam Reply with quote

Aloha from Maui,

I have a website hosted on a windows 2008 server R2 using IIS7 and PHP (5.6 I believe) with fastCGI. I did not create the site and I'm not PHP friendly. The creator is quite the newbie as well but he used Joomla and did a pretty good job on the site. However, he doesn't know how to turn off all the email features. There is no "contact us" form or "send to a friend" link, it's just a basic static site.

The IP address wound up on the RBL's because this website is spamming. I tried locking down port 25 on the windows firewall but it somehow manages to find its way around. Blocking port 25 at the router is not a good solution because this thing keeps trying to spam and it's slowing the machine way down.

I've tried looking at various logs. I could never make the PHP log work but I looked at the IIS logs, SQL logs, etc. and couldn't find anything related to what PHP file is doing this.

Anybody want to try and help me locate this? Confused

Thanks in advance.
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7288
Location: Germany, Next to Hamburg

PostPosted: Tue 29 Mar '16 9:56    Post subject: Reply with quote

From PHP 5.3 you can log the script and the mail

see http://php.net/manual/en/mail.configuration.php

if you still have a question plese ask again.
Back to top
Qwazi



Joined: 28 Mar 2016
Posts: 2
Location: Maui

PostPosted: Tue 29 Mar '16 18:30    Post subject: Reply with quote

OK, so I read that entire article and all the replies. I don't know what to do.

I've modified the PHP.INI file. I simply commented out all the mail functions but it still sends mail.

If I set these functions specific, what would I use to simply stop all mail from occuring? Or could I set it up to at least dump these emails in someplace benign?

Thanks again.
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7288
Location: Germany, Next to Hamburg

PostPosted: Thu 31 Mar '16 12:20    Post subject: Reply with quote

You need to set it like

Code:
mail.log = C:/mail.log


Then you will know which script does send mail.

if you don't want to send any mails via php from your server you can use disable_functions in php.ini to diable the php mail function.
Back to top


Reply to topic   Topic: tracking down php script sending spam View previous topic :: View next topic
Post new topic   Forum Index -> Other Software