Re: Debian Wheezy Compromised - www-data user is sending 1000 emails an hour

[Bob Bernstein <poobah@ruptured-duck.com>]

On Wed, Dec 11, 2013 at 08:57:57PM -0600, Lukasz Szybalski wrote:

>    I run my own site, and I do have postfix, apache, wordpress, 
>    and moinmoin installed. www-data is sending 100s of emails a 
>    minute.

I hope you have by hook or crook pulled the plug on this system by 
now. I believe you have had a close encounter of the maddening kind 
with sql injection. I wish I had a quick url to which to send you, 
but google 'sql injection php' after you shut down postfix.

May one ask what hosting provider are you using?

Please note the above is merely *suggested* as I have no expertise 
in these matters beyond what happened to me some time ago. Good 
luck.
 
-- 
Bob Bernstein

    I am dissatisfied, profoundly so, with the world as it is. But I 
    would be dissatisfied with any world. And I'd hate to lose my 
    dissatisfaction.

                                       Alfred Kazin