How to find which PHP file is currently running?

elisom

• February 06, 2019 05:48

My server got hacked and a php files keep trying to send spam. How can i find which files are running now?

• 

  cPanelLauren

  • February 06, 2019 18:03

  Hi @elisom The best thing to do is find the PHP file sending the spam. We have a script we run internally that might be helpful for you: perl <(curl -s https://raw.githubusercontent.com/cPanelTechs/SSE/master/sse.pl) -s
  The portion "Directories mail is originating from:"specifically. There are of course other methods that can be used such as those noted in the threads as follows:

  0
• 

  elisom

  • February 06, 2019 20:42

  Thank you. when i run it i get 0 results, but both devcot and exim sending mails non-stop

  0
• 

  cPanelLauren

  • February 07, 2019 12:03

  Hi @elisom When you're running this or any of the suggestions I've provided are you logged in as the root user? I can confirm any one of the three commands I provided does work, I've used them all myself.

  0
• 

  elisom

  • February 07, 2019 12:18

  Yes. sure. The script work - no error. but gives 0 results.

  0
• 

  dalem

  • February 07, 2019 12:19

  ditto works without issue

  0

Please sign in to leave a comment.