Найти источник спама на сервере

Нужно найти и удалить источник спама на сервере Linux, CentOS.

Сервер был взломан и видно где-то внедрен спамерский код.

Пришло письмо следующего содержания:

"Здравствуйте.

Поступили жалобы на рассылку спама, связанного с вашим сервером.

Пожалуйста, примите меры и сообщите нам о достигнутых результатах.

Обратите внимание на то, что это противоречит нашим Правилам пользования

услугами. И при повторных инцидентах мы будем вынуждены прекратить

обслуживание вашего сервера и расторгнуть договор.

-------- Original Message --------

Subject: [SpamCop (94.127.67.105) id:5538888937]Love message/34295026

Date: Sat, 18 Jun 2011 14:24:26 -0300

From: Tiago <@reports.spamcop.net>

To: [email protected]

[ SpamCop V4.6.1.007 ]

This message is brief for your comfort. Please use links below for details.

Email from 94.127.67.105 / Sat, 18 Jun 2011 14:24:26 -0300

http://www.spamcop.net/w3m?i=z5538888937z8eb9a271bc8098ab4d1692eb0a59eb85z

[ Additional comments from recipient ]

> (This message will follow in English)

> Olб,

>

> Eu recebi a mensagem nгo solicitada em anexo, favor certificar-se que o indivнduo seja adequadamente punido e proibido de enviar mensagens semelhantes! Nгo quero mais SPAM!

>

> Segundo o Cуdigo de Йtica AntiSPAM, toda mensagem indesejбvel sem a prйvia aceitaзгo й sim considerado SPAM, por mais que tenha uma opзгo funcional de remoзгo, inclusive usar lista de terceiros й uma prбtica desagradбvel e anti-йtica, se o fez favor informar a fonte para que se possa identificar o real responsбvel por esta prбtica ilegal!

>

> Qualquer um que compactuar com esta prбtica criminosa serб considerado cъmplice a nгo ser que colabore com o fim da mesma, neste caso meu perdгo serб concebido!

>

> Grato,

>

> Tiago

>

> ----

> English version:

>

> Hello,

>

> I received the attached unsolicited message, please make sure the person shall be properly punished and forbidden to sending messages such that! I don't want SPAM anymore!

>

> Acording to the AntiSPAM Code of Ethics, every unwanted message without before opt-in is called SPAM really, even though there is a functional opt-out, in addition to use others' list is a disgusting and unethical custom, if so please tell who is the source to be identified the real indicted for this illegal practice!

>

> Anyone who collude with this criminal act will be considered an accomplice, unless you help with it's end, in this case I'll give my forgiveness!

>

> Thanks,

>

> Tiago

[ Offending message ]

Return-path:

Envelope-to: x

Delivery-date: Sat, 18 Jun 2011 14:24:26 -0300

Received: from s094127067105.m.truevds.ru ([94.127.67.105]:54702)

by sbr2.hostdime.com.br with smtp (Exim 4.69)

(envelope-from )

id 1QXzFx-0003Ts-4G

for x; Sat, 18 Jun 2011 14:24:26 -0300

Date: Sat, 18 Jun 2011 21:24:25 -0400

From: jackiee

To:

Message-ID:

Subject: Love message/34295026

MIME-Version: 1.0

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: 7bit

X-WDIG-SWID: 81S6469Z-FW7F-RF7V-C8Q7-A2C29CF9DE97

X-WDIG-SITE: UK.EN.SES

X-Spam-Status: No, score=4.2

X-Spam-Score: 42

X-Spam-Bar: ++++

X-Ham-Report: Spam detection software, running on the system

"sbr2.hostdime.com.br", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

/usr for details.

Content preview: Turning back was vain, Greetings pass-holder As Tom was a

sleeping he had such a sight, NEW:Questionary-34295026: First name: Simona.

Surname: Potselueva. The killer's sleep is haunted, dead man said, Country:

Belarus. City: Perm. Age: 23. Height: 175 centimetres Weight: 52 kilograms.

Eyes: green. Hair Color: blond. Her Type of Man: I wish to share my life

with a kind man with a good sense of humor. Character: I am an attractive,

slim, good-looking woman. [...]

Content analysis details: (4.2 points, 5.0 required)

pts rule name description

---- ----------------------

--------------------------------------------------

1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

1.5 BAYES_60 BODY: Bayes spam probability is 60 to 80%

[score: 0.6888]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar to background

0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 RFC_ABUSE_POST Both abuse and postmaster missing on sender

domain

X-Spam-Flag: NO

Turning back was vain,

Greetings pass-holder

As Tom was a sleeping he had such a

sight,

NEW:Questionary-34295026:

First name: Simona.

Surname: Potselueva.

The killer's sleep is haunted, dead

man said,

Country: Belarus.

City: Perm.

Age: 23.

Height: 175 centimetres

Weight: 52 kilograms.

Eyes: green.

Hair Color: blond.

Her Type of Man:

I wish to share my life with a kind man with a good sense of humor.

Character:

I am an attractive, slim, good-looking woman.

Interests:

Swimming, being outdoors, sewing something modern for both of me.

Farewell!

Grace and glimmer of romance;

"