Re: Debian Wheezy Compromised - www-data user is sending 1000 emails an hour

[Reco <recoverym4n@gmail.com>]

 Hi.

On Wed, 11 Dec 2013 22:03:24 -0600
Lukasz Szybalski <szybalski@gmail.com> wrote:

> and here it is:
> /usr/share/wordpress/wp-content/themes/itheme/checkoutDj4.php
> 
> I deleted this file and others who were created there on Dec 5th. *Now how
> were they able to save a file in there?*
> 
> Any idea how to check that?
> www-data user owns that folder and files.

This. Why do you allow webserver to write
into /usr/share/wordpress/wp-content/themes/itheme/?
Does Wordpress needs to be allowed to write in there?
What does 'find /usr -uid 33' show?

This directory is part of /usr, and stock Debian configuration assumes
that everything below /usr/share belongs to root.

Reco