Just removed a nasty little mailer script (WP)

[Alien]

Just noticed some odd activity in my mail queue on one of the dedicated. Lots of mails bouncing to Indian e-mail addresses.

Some poking about on one of my WP sites that was referenced in the mails found a script called 'cll.php' in one of my CHMOD 777 folders, called "FSS Mailer 2012".

It was being used to mail through the server. Removed it and the rest of the stuff there, changed folder permissions now.

I've replaced the file with an alternative 'get lost' message. But, does anyone have any ideas on what I could place there instead to get their attention?! :evil::evil::evil::evil:

It might be interesting to log who goes there too actually...

 

[Admin]

You did well to spot it. Would be interesting to have installed the WordPress Anti Virus Plugin to see if it detected it.

Admin

 

[atlas]

Might want to make sure your IP address hasn't been blacklisted by any ISPs.

 

[PoshTiger]

also - do you know how the script actually got there in the first place?

There may be an underlying vulnerability somewhere..