Can you take a look at these scripts?

[WebUnleashed]

Hi guys,
Today I found 2 specific files on 3 of my hosting accounts.
"seed.php and seed2.php".
By looking at them, I am pretty sure they are used for spamming.
Can you also take a look and tell my your opinion?
I also suspended the suspicious accounts just to be safe.

Thanks in advance.





Download Link

 

[Dynash]

I would say it is.

print "<b><font color=\"#FFFFFF\" face=\"Georgia\" size=\"1\">Sending messages...</b>";
echo("<BR><BR><font color=\"#FFFFFF\" face=\"Georgia\" size=\"1\"><b>from</b>: $from<br>
<b>subject</b>: $sbj<br>
<b>message</b>: $msg<br>");

 

[Decker]

Why didn't you just put the zip in your account so it could be downloaded, the rapidshare verification crap screws up all the time for me.

 

[WebUnleashed]

Why didn't you just put the zip in your account so it could be downloaded, the rapidshare verification crap screws up all the time for me.

For some reason I'm not allowed to upload files.
I don't know, maybe I need more posts on the forum.

 

[Dynash]

PHP isn't on the allowed filetypes anyway.
"bmp doc gif jpe jpeg jpg pdf png psd txt zip"

i added them as text files. (seed2 is the same as seed, but with like 1 variable changed.)

 

[BananaMaster]

For some reason I'm not allowed to upload files.
I don't know, maybe I need more posts on the forum.

Thats probablt the reason, but rapidshare is rubbish, i've failed the verification a million times!!!

 

[Decker]

For some reason I'm not allowed to upload files.
I don't know, maybe I need more posts on the forum.

I meant on your own domain account as your a host :wink2:

Look for these files in accounts too (use locate);

cpaisj.php
orly.doc
lov.doc

They reference this site - veryexclusive.info

Triggered by http://veryexclusive.info/singlemailgo.php, owner well whois it.

Registrant Name:Nick Monte
Registrant Organization SP55 Marketing
Registrant Street1:55 Oasis Ave
Registrant Street2:
Registrant Street3:
Registrant City:Montauk
Registrant State/Province:New York
Registrant Postal Code:11954
Registrant Country:US
Registrant Phone:+1.2124201337
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:sp55domains@gmail.com


Liquidweb server, so report abuse to them too.

 

[Dynash]

I just found this thread at WHT: http://www.webhostingtalk.com/showthread.php?t=683249

check what the user is using, something called "seed.php", so it's obviously 100% this is used to spam

 

[Decker]

Looks like the details at post #7 are the offender then