I just got an email from my host saying something similar. They said to check my mail logs to see which script is being exploited. It looks like spamx is being exploited? Any suggestions on how to solve this?
Text Formatted Code
2007-12-10 12:52:29 u35565200 3oUgls-1J1mnt2mdy-0005zH |< REMOTE=41.211.226.167 SCRIPT=/club80s/plugins/spamx/templates/s.php -- /usr/sbin/sendmail -t -i
2007-12-10 12:52:29 u35565200 3oUgls-1J1mnt2mdy-0005zH <= S=accounts.verisign@key.com SZ=4166 D=0 SID=90628944
2007-12-10 12:52:31 u35565200 3oUgls-1J1mnt2mdy-0005zH => johnboy3159@yahoo.com msmtp.perfora.net[172.19.143.3] 250 Message 0MKp8S-1J1mnt36ye-0006RO accepted by mrus0.perfora.net
2007-12-10 12:52:31 u35565200 3oUgls-1J1mnv3Pci-0005zd |< REMOTE=41.211.226.167 SCRIPT=/club80s/plugins/spamx/templates/s.php -- /usr/sbin/sendmail -t -i
2007-12-10 12:52:31 u35565200 3oUgls-1J1mnv3Pci-0005zd <= S=accounts.verisign@key.com SZ=4167 D=0 SID=90628944
2007-12-10 12:52:33 u35565200 3oUgls-1J1mnv3Pci-0005zd => johnboy38375@yahoo.com msmtp.perfora.net[172.19.143.3] 250 Message 0MKp8S-1J1mnv3gdN-0006Lm accepted by mrus0.perfora.net
2007-12-10 13:58:40 u35565200 3oUgls-1J1npw11YB-0002OY |< REMOTE=82.78.173.224 SCRIPT=/club80s/plugins/spamx/Mass.php -- /usr/sbin/sendmail -t -i
2007-12-10 13:58:40 u35565200 3oUgls-1J1npw11YB-0002OY <= S=cgi-mailer-bounces-90628944@perfora.net SZ=695 D=0 SID=90628944
2007-12-10 13:58:42 u35565200 3oUgls-1J1npw11YB-0002OY => kaiowas2000@gmail.com msmtp.perfora.net[172.19.143.3] 250 Message 0MKpCa-1J1npx0asO-0001wq accepted by mrus1.perfora.net
2007-12-10 13:58:55 u35565200 3oUgls-1J1nqB0wKW-0002R0 |< REMOTE=82.78.173.224 SCRIPT=/club80s/plugins/spamx/Mass.php -- /usr/sbin/sendmail -t -i
2007-12-10 13:58:55 u35565200 3oUgls-1J1nqB0wKW-0002R0 <= S=cgi-mailer-bounces-90628944@perfora.net SZ=695 D=0 SID=90628944
2007-12-10 13:58:56 u35565200 3oUgls-1J1nqB0wKW-0002R0 => kaiowas2000@gmail.com msmtp.perfora.net[172.19.143.3] 250 Message 0MKp8S-1J1nqB2cVu-0006QH accepted by mrus0.perfora.net
2007-12-10 13:59:05 u35565200 3oUgls-1J1nqL0bJq-0002Ti |< REMOTE=82.78.173.224 SCRIPT=/club80s/plugins/spamx/Mass.php -- /usr/sbin/sendmail -t -i
2007-12-10 13:59:05 u35565200 3oUgls-1J1nqL0bJq-0002Ti <= S=cgi-mailer-bounces-90628944@perfora.net SZ=695 D=0 SID=90628944
2007-12-10 13:59:06 u35565200 3oUgls-1J1nqL0bJq-0002Ti => kaiowas2000@gmail.com msmtp.perfora.net[172.19.143.3] 250 Message 0MKp8S-1J1nqL0yNw-0006Bx accepted by mrus0.perfora.net