Host blocked website due to sending spam from website My hosting provider has blocked my Drupal website due to:
sending spam using local e-mail sockets /var/www/vhosts/site domain/httpdocs/sites/all/themes/chaymae/css/mailer.php.php

I am currently not using the mentioned theme, but this is a standard theme in Drupal. 
I also have installed the BOTCHA module on the website and it's active.
Can anyone help to solve this problem?
Your hosting provided blocked your website, because it was used for sending the spam from using PHP scripts which were suspiciously uploaded to your Drupal installation folder (by using some vulnerabilities).



Why this happened?

There could be many issues, including contrib modules or Drupal core vulnerabilities.

Please follow Drupal Security advisories to be up-to-date.

If your Drupal version is 7.32 or below, there is Highly Critical issue (SA-CORE-2014-005) which people call Drupalgeddon. See FAQ and Drupalgeddon project for more details. Also my GitHub repo (drupageddon) for educational purposes (to understand how it works).



What to do

To prevent that from happening, first of all, check Status/Reports in Administer page to see if you've any Security warnings and your site needs some upgrades.

Then you may consider to log-in to the website (ssh) and scan for suspicious files.

You should look into these tools to help you with restoring your Drupal security:


Security Review
Site Audit
Hacked!


  If you use drush (and you've alias set-up to your environment), check for Hacked! module. It can find which core files or modules were hacked, but it could find only modified one, not the one which are extra.





If you're using drush, other trick can be to generate your make file (drush generate-makefile) from your current Drupal site (however this is probably not necessary, but it keeps track of your old version of modules), then run drush up. This will upgrade your Drupal core and all contrib projects and apply any pending database updates. How would that help? It'll actually upgrade all core/module files by replacing old directories with fresh version of stable release files (so any extra files which aren't part of the module would be automatically removed).

Finding suspicious files

To fix your infected website installation, you need to find files which were hacked and malware files in your Drupal installation folder.

You actually found one at (which is a good start):


  /var/www/vhosts/site domain/httpdocs/sites/all/themes/chaymae/css/mailer.php.php


which needs to be removed as soon as possible. Probably you have more of them.

If there is no access to shell, transferring over FTP (ncftpget -R) and checking locally would help. Or find other way to backup your whole site and test it locally for any extra files or hacked files.

If you don't use git, I would suggest you to download your Drupal site into folder and create git repository, so you can track the changes.

For example:

git init
git add -A .
git commit -m 'My original files.' -a


Then upgrade all your core and modules and review the changes (git diff), and commit all again.

Here are few commands which can be useful to find suspicious files (in your webroot):

grep -R return.*base64_decode  .
grep --include=\*.php -rn 'return.*base64_decode($v.\{6\})' .
find . -name \*.php


Above results doesn't mean necessary suspicious files, but you need to use your common sense to identify which files aren't Drupal. Usually these files are obfuscated.

Please find the following repository with common php-exploit-scripts to give you some idea what you could deal with. See also: What does this malicious PHP script do?

Unblocking your site

Once you find your problem and identified malware files, then remove these files from the server and upgrade your core and modules to the recent secure version and inform your hosting provider that you've removed malware so they can unblock your site.