Spam problem, Disable default account email

[cybermaster]

Recently we notice some Trojans try to send spam email's via user@Hostname and PHPMAIL Class can connect smtp and send email.
we changed user password many times but still Trojans can send email.

I search google but can not find solution for this problem, we want to disable default user email account or at least it can only receive email and cant send.

 

[zEitEr]

Hello,

Whether or not you disable the default email account it won't hep you to protect your server against sending SPAM.
I'd suggest that you use CustomBuild to install PHP+Suhosin+Clamav, exim.conf 4.3+BlockCracking. It should help.
Then install maldet to check your users homedirs for malware.

All of these I could do for you in terms of a commerce service, please feel free to PM me for a quote.

 

[nango]

I have same problem this made me crazy.
The problem is user@hostname sending spam from customers joomla/wordpress and other CMS's.
I will limit users or I will found exactly spam sender file like this:

public_html/administrator/components/com_postinstall/views/diff.php

If I delete it will come like mushrooms from another folder in a week, If I suspend domain I will lose customer and next week comes from new domain, in all cases the user@hostname is sender.
This will happen when maldet found nothing.
Is there a way to prevent sending email from user@hostname?

 

[zEitEr]

Disable PHP mail() if you don't afraid a possibility to loose a customer.
Other solutions can be found in the thread here #2

 

[nango]

First thanks for reply.

for other solutions Clamav, rkhunter, maldet, csf-bfd ... are temporary good but this tools cant help for long time in this case. Suhosin that I installed today may help. I am new at this and should try some configs to protect servers from bad scripts.

Is it possible to disable php mail without disabling Mail server?
As I know Joomla and other CMS's can use php mail and/or SMTP method, can I disable php mail and force users to use SMTP with authentication for send mail?

 

[zEitEr]

Add mail into disable_functions of php.ini.

Related:

http://php.net/manual/en/ini.core.php

- Where is my php.ini?
http://help.directadmin.com/item.php?id=301