title: Spambot on Ubuntu Server running Nginx and PHP
body: <p>My VPS is infected with a spambot. I receive emails from the VPS host informing me spam emails are being sent and it locked down port 25.</p>
  <p>I'm running Ubuntu (21.10) &amp; Nginx (1.18.0) web server.</p>
  <p>I've re-enabled port 25 to try to get to the bottom of where the spambot is by monitoring the post-fix mail queue and examining the headers.</p>
  <p>What I am looking for is the originating script sending these emails...</p>
  <p>postqueue -p</p>
  <p>-- This gives me a breakdown of all the emails sent by the server in the mailqueue.</p>
  <p><a href="https://i.stack.imgur.com/nXtW0.jpg" rel="nofollow noreferrer">Mail Queue</a></p>
  <p>postcat -q CA4784615B 37C</p>
  <p><a href="https://i.stack.imgur.com/V6Ehy.jpg" rel="nofollow noreferrer">Email Header</a></p>
  <p>--- This command when applied to the message ID of a sample spam email gives me attached information.</p>
  <p>I think I need to find the originating PHP script, so I have enabled logging that in the header of emails.</p>
  <p><a href="https://i.stack.imgur.com/QxMcC.jpg" rel="nofollow noreferrer">Enabled PHP Originating Script Logging</a></p>
  <p>When I look at the header of emails after enabling X-PHP-Originating-Script logging, it still doesn't show what it sending the emails or location.</p>
  <p>Can anyone help? This is really annoying my customers as no emails are being sent by the server and all contact forms are down.</p>
  <p>Thanks,</p>
  <p>Adam</p>
  <p><strong>EDIT</strong> Found a potential solution:**</p>
  <p>I installed Sophos v9 antivirus for Linux:</p>
  <p><a href="https://www.sophos.com/en-us/support/downloads/endpoint-client" rel="nofollow noreferrer">https://www.sophos.com/en-us/support/downloads/endpoint-client</a></p>
  <p>Enabled on-demand scanning and ran a quick scan:</p>
  <p>It found this:</p>
  <p><a href="https://i.stack.imgur.com/CXGCv.jpg" rel="nofollow noreferrer">Sophos Results</a></p>
  <p>Minus the domain names in question, it found PHP/WebShell-O -- an exploit that can be used for botnets.</p>
  <p>Since wiping all the files in question, unblocking port 25 at the network layer &amp; watching the mail queue, I don't see any spam!</p>
  <p>Will keep monitoring, but this might be the end of it!</p>