I few months ago i solved a similar problem with this simple method:
http://blog.rimuhosting.com/2012/09/20/finding-spam-sending-scripts-on-your-server/
Your php.ini's location (probably): /var/www/vhosts/system/"DOMAINNAME"/etc/php.ini
I hope it helps
Hello!
Since 12.5.30 update i have set up some incremental backups for some domains.
My "Backup Manager" and "Migration and Transfer Manager" now fail to open. ("xmlSchemaParse() failed" shows)
I can't see these packages in "updates and upgrades" menu, so i can't reinstall them.
I run Debian...