Spam Coming from my Website

martindow

One of my sites has been apparently been sending large quantities of spam. The host took the site down for a few hours and after that the spam stopped. Looking at the remote site files there is nothing obviously different from the local files on our PC.

The hosting people seem sure the spam is originating from our site but I think it could be that the emails are addressed to us presumably with BCCs meaning a lot of traffic is passing through.

Can anyone advise how to proceed to check everything is sorted?

Figment

Your host should be able to check server logs to determine if the spam is coming from your site. It's possible they have hacked into your account and using the outgoing SMTP server. First step should be to change your login passwords for the site and email/webmail (if different).

martindow

The passwords are now changed. Is there anyway of checking whether there is anything malevolent in place on the site itself?

chib

Is it a Wordpress site, if so - it could be an extension?

martindow

chib wrote: »

Is it a Wordpress site, if so - it could be an extension?

No it's a straightforward html site made on Dreamweaver and an Actinic shopping cart. I removed a form sometime ago as I understood that could be vulnerable.

Figment

martindow wrote: »

The passwords are now changed. Is there anyway of checking whether there is anything malevolent in place on the site itself?

Only by the slow process of checking every file/folder, or you could use the Synchronise feature in Dreamweaver to compare the remote and local copies, which would show any files on the remote that you don't have locally. This assumes the local copy was up to date and hasn't been synch'd since this problem began

martindow

Thank you everyone. I thought I would come back having hopefully resolved this.

We have followed your advice, scanned the computer, changed passwords, deleted the site from the host and resubmitted the site from saved files. However the problem seems to have occurred as the result of a vulnerability in a form in actinic used to send an email from the site. This has been taken off the site we are hoping that all is now well.