Find spam script location with Exim

Luckily Exim which is the MTA (Mail Transfer Agent) on your server which handles email deliveries, logs all activity sent into it from scripts. It does this by logging the current working directory from where the script was executed. Using this knowledge you can easily track down a script of your own that is being exploited to send out spam, or locate possibly malicious scripts that a spammer has placed onto your server.

In order to follow along with the steps below you'll need to have root access to either your VPS or dedicated server so that you have access to the Exim mail log.

#Locate top scripts sending into Exim

Using the steps below I'll show you how to locate the top scripts on your server that send out email. You can then search the Exim mail log for those scripts to determine if it looks like spam, and even check your Apache access logs in order to find how a spammer might be using your scripts to send out spam.
grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n
Code breakdown:
You should get back something like this:
15 /home/userna5/public_html/about-us
25 /home/userna5/public_html
7866 /home/userna5/public_html/data
Here we can see that the /home/userna5/public_html/data directory by far has more deliveries coming in than any others.

ls -lahtr /userna5/public_html/data

grep "mailer.php" /home/userna5/access-logs/example.com | awk '{print $1}' | sort -n | uniq -c | sort -n
You should get back something similar to this:
2 123.123.123.126
2 123.123.123.125
2 123.123.123.124
7860 123.123.123.123
So we can clearly see that the IP address 123.123.123.123 was responsible for using our mailer script in a malicious nature.

You should now have learned how to use your server's Exim mail log to see what scripts on your server are causing the most email activity, and also how to investigate to see if any of them are malicious in nature trying to send out spam from your server.