I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised.
Basically, someone is using my email account to mass send spam. I've changed all the passwords and everything but when my Gmail pulls the emails from the host it's still downloading loads of spam messages that show like this:
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[email protected]
SMTP error from remote mail server after end of data:
host 198.91.
80.251 [198.91.
80.251]: 554 5.6.0 id=23634-03 - Rejected by MTA on relaying, from MTA([127.0.0.1]:10030):
554 Error: This email address has lost rights to send email from the system
------ This is a copy of the message, including all the headers. ------
Return-path: <
[email protected]>
Received: from keenesystems.com ([66.135.33.211]:2370 helo=server211)
by absolut.x10hosting.com with esmtpsa (TLSv1:RC4-MD5:128)
(Exim 4.77)
(envelope-from <
[email protected]>)
id 1TGwSW-002hHe-Lc
for
[email protected]; Wed, 26 Sep 2012 13:35:44 -0500
MIME-Version: 1.0
Date: Wed, 26 Sep 2012 13:35:43 -0500
X-Priority: 3 (Normal)
X-Mailer: Ximian Evolution 3.9.9 (8.5.3-6)
Subject: New staff members wanted at Auction It Online
From:
[email protected]
Reply-To:
[email protected]
To: "Nadia Monti" <
[email protected]>
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Message-ID: <OUTLOOK-IDM-9aed7054-6a3e-e1a4-1d5c-3e73377652a6@server211>
Date : 26 September 2012=0ATime : 13:35=0ASender : Dennise Halcomb Head =
Office Manager of RJ Auction Drop-Off Int.=0A=0ANice to meet you Nadia M=
onti=0A=0ARJ ADO Ltd., a USA based company, offers a significant amount =
of goods worldwide for our customers on eBay and other auction venues. =
Our company's main target is to provide a suitable and cost-effective se=
rvice for any person, company or fundraising company. The main purpose o=
f the administrative assistant / sales support representative is to cont=
ribute to the sales force and add convenience to our cost-effective serv=
ice dedicated to individuals, businesses, and organizations worldwide. O=
ur HR department obtained your resume from one of the various job-orient=
ed websites just to offer you this post.=0A=0AWorking Schedule: This is =
a part time and home-based offer. You won't need to spend more than 3 ho=
urs each day. Your =0Aschedule will be flexible.=0A=0ASalary: At the end=
of the trial period (it lasts for 1 month) you will be paid 1,800 EUR. =
With the average volume of clients your overall income will raise up to =
3,000 EUR per month. After the trial period is over your base salary wil=
l grow up to 2,500 EUR per month, so you will earn 5% commission from th=
e transactions completed.=0A=0AWhere?: Italy Wide. As it is a stay at ho=
me position all the communication will be carried out via email and via =
phone.=0A=0ARequirements: Access to the internet during the workday and =
basic microsoft office skills are needed. Basic knowledge of English is =
required (most of the contacts will be in English).=0A=0ACosts and Fees:=
There are NO costs at any time for our employees. All fees related to t=
his position are covered by the RJ ADO Co. Ltd..=0A=0AFurther Hiring Pro=
cess: If you are interested in position we offer, please reply to this e=
mail and send us the copy of your resume for verification.=0A=0AAfter re=
viewing all of the received applications we will reply to successful app=
licants only. Then we'll offer to these successful applicants a position=
within our firm on a trial period basis for one month beginning from th=
e date you sign a trial agreement. During this trial period you will rec=
eive full guidance and support. Employees on a one monthly trial period =
are evaluated at least one week prior to the end of their trial. During =
the trial, your supervisor can recommend termination. At the end of the =
trial period, the supervisor can offer continued employment, extension o=
f trial period, or termination. After the trial period you may ask for m=
ore hours or continue full-time.=0A=0AIf you are interested in this posi=
tion, just reply to this email and send any questions you have and the c=
opy of your resume for verification.=0A=0AThank You,=0AHR-Manager of RJ =
ADO Co. Ltd.=0A=0APermission Settings=0AYou have been referred to RJ Auc=
tion Drop-Off If you feel you received this email in error or do not wis=
h to receive future messages, please reply to this message with "remove"=
in the subject field. We will immediately update our database according=
ly. =0AWe apologize for any inconvenience caused.=0A=0ARJ Auction Drop-O=
ff Co. Ltd.
I'm not aware of how this has happened. I'm not sure how anyone could have got hold of my password. It's a simple wordpress install, at some point recently my host went down and there was a fresh install of wordpress with default admin accounts, I have a feeling it could be something to do with this. My question is, even though I've changed all my passwords it's all still happening, is there annywhere in paticular this script would be stored on my host. I really can't deal with having my hosting account suspended and my email account sending all this spam.
