Recent content by Hossie

I can confirm wordpress was installed on our box that was compromised. Our new mission critical production box will never again host a CMS. All old blogs are now proxy passed to trashable virtual machines. Thanks everyone.

Can you paste that code? my /tmp/sess_ was deleted (by the virus?).

JuanCar – This ‘virus’ uses the system call to send mail. This means that all emails the ‘virus’ sends are passed to Qmail. It does NOT try to open a port/socket and act as its own MTA. Thus the only useful thing you can do with Iptables is to completely block outbound dport 25. Your example...

We have a very similar issue. OS: CentOS release 5.8 (Final), plesk psa-9.5.2-cos5.build95100504.10 Running litespeed, qmail, php, multiple vhosts (some have wordpress but we are not sure if this is the exploit path). The server was bogged down with the email spam blast. I stopped qmail so...

We have a very similar issue. OS: CentOS release 5.8 (Final), plesk psa-9.5.2-cos5.build95100504.10 Running litespeed, qmail, php, multiple vhosts (some have wordpress but we are not sure if this is the exploit path). The server was bogged down with the email spam blast. I stopped qmail so...