Drupal Sending tons of Spam email Apparently one of the modules installed on my drupal site has been sending SPAM emails from my server as in (name)_(lastname)@(myservername).com , it managed to send 1000 email and queue 97,000 emails only in the first day..

At first, based on the email details, I figured it was being sent from a PHP page called diff.php under /sites/all/modules/contrib/libraries/tests/libraries/diff.php, so I deleted the whole tests folder, but now the emails are heading directly from my root site..
I have installed Hacked! to a development copy, and here's a copy of the results:


Does it seem like a module issue? should I re-install the changed modules?
The version of core you're running - 7.30 - is extremely vulnerable.  As long as you're running any version of core prior to 7.32, your site will remain vulnerable.  The vulnerability will allow changing modules (which can be discovered with the Hacked! module), putting executable PHP in the database (which can not be discovered with Hacked!), and injecting malicious shell scripts (which can not be discovered with Hacked!).

Simply replacing Drupal core and modules with non-hacked versions will not remove backdoors.

Just going through the changed modules and reinstalling them will not do.  At this point, even if you replace everything, the intruder have probably infected your database with exploits, as well as having installed several well-hidden backdoors to your site at shell level.

The best recourse is to delete your entire site an rebuild it from scratch on a clean vhost, then restore its contents from a backup made prior to Oct. 15, 2014.

Read this SA to understand the severity of this vulnerability: https://www.drupal.org/SA-CORE-2014-005. Also read:


https://www.drupal.org/node/2357241
http://www.linuxjournal.com/content/drupageddon-sql-injection-database-abstraction-and-hundreds-thousands-web-sites


If you're unable to delete the site and restore from backup, read this about recovering: Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?.

After you have cleaned up your site, to be alerted if this happens again, consider installing File integrity check. This module will monitor the integrity of almost all files on your site and send you an email if it detects that file integrity is breached.