My web server company recently reported me that my website is sending spams. I scanned the whole file system and found a number of infected php files like index.main.php, ipopup.php and wtm9309n.php in sites/default/files
directory.
All permissions for files and directories are set correctly. I have only one custom content type having 2 textbox fields that all users can create a new content of that type.
I checked the files
table in database. except my uploaded files, there was no other files listed there, so (I think) that means the infected files are not uploaded via upload forms.
This is the only infected website among of the tens in my web server, so I think this a problem with this website instead of other things like OS vulnerabilities and ...
Enabled modules:
- admin
- cck
- contact_forms
- faq
- filefield
- imageapi
- imagecache
- imagefield
- imce
- nice_menus
- node_export
- views
Any suggestion? (Drupal 6.20)