Hi guys. Last night my hosting provider suspended my account because of sending out spam mail!
Here is the logs:
2014-09-23 17:00:44 1XWQe2-000CKM-Bn <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1060 T=”Geblokkeerde Rekening” for g.j.groot@quicknet.nl
2014-09-23 17:00:46 1XWQe5-000CLA-2b <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1056 T=”Geblokkeerde Rekening” for g.j.gunnink@home.nl
2014-09-23 17:00:50 1XWQe6-000CLc-44 <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1052 T=”Geblokkeerde Rekening” for gjdegraaf@home.nl
2014-09-23 17:01:58 1XWQfF-000CyX-5m <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1049 T=”Geblokkeerde Rekening” for g.scheepstra@hetnet.nl
2014-09-23 17:01:59 1XWQfG-000Cz8-Dp <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1043 T=”Geblokkeerde Rekening” for gruppe01@kpnmail.nl
2014-09-23 17:02:00 1XWQfH-000Czg-Ip <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1053 T=”Geblokkeerde Rekening” for g.scheerder@kpnplanet.nl
2014-09-23 17:02:56 1XWQg8-000DUd-CI <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1066 T=”Geblokkeerde Rekening” for h.a.egberts@kpnmail.nl
2014-09-23 17:02:57 1XWQgC-000DVb-Hz <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1058 T=”Geblokkeerde Rekening” for hacojoma@hetnet.nl
2014-09-23 17:03:03 1XWQgD-000DWH-Nl <= sanalsan@umbra.guzelhosting.com U=sanalsan P=local S=1062 T=”Geblokkeerde Rekening” for h.a.devrij@xs4all.nl
here is my plugins:
http://prntscr.com/4pv3gf
what should i do, please help me đ
Talk to your web hosting provider to determine what you have in place to allow spam. Are you allowing people to sign up for accounts? Do you have some kind of contact form which sends reply emails? Have you checked the WordPress.org forum for any plugins not included with the theme to see if they have been compromised? Have you double checked any plugin which is a commercial plugin from Envato, which may be compromised?
The theme by itself cannot generate spam, so you should deactivate anything not included with the theme as a starting point.
Check your contact form — allowing people to post messages with a reply to email sent automatically is instant spam as people can fill out a form, then use somebody else’s email account as the copy for auto reply.
ANY form somebody can fill out on your website should be checked.
Plan from WordPress codex on what to do if site has been hacked:
