Unable to find out spamming scripts

[ositis]

Dear all,
Recently I've been attacked by some kind of a exploit that I am now trying to remove and make sure that it does not happen again, but so far all my attempts are failing.

I am now trying to take a different approach and remove all the scripts that are trying to send the spam. I found on another forum, that you could use this command to find out the directories of the spaming scripts.

# grep cwd /var/log/exim/mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

However, when running it all i get is this

[root@23012 ~]# grep cwd /var/log/exim/mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n
      2
[root@23012 ~]#

Could you please help me with this and maybe give me additional advice on how to fight these spambots?

Any help will be appreciated!

 

[defomaz]

If spam come from user account, I usually check user email usage.
some kind like this http://panduan.pusathosting.com/wp-content/uploads/2014/02/email-usage-php-mail.jpg