Vesta Control Panel - Forum

Can someone tell me what i can do here ?

It's not very hard.

First analyzes on how many list is your IP: http://multirbl.valli.org/lookup/

Then send an email to each list and ask to be removed from it.

Also try with: http://www.sorbs.net/ -> Delist an IP Address

i am trying to figure out how to find which account is compromised on the server
the logs in /var/log are no help

Use mailq for see your log queue.

exim -Mvh message-id-from queue -- headers
exim -Mvb message-id-from queue -- body message

Search php script, which send all this spam mail.
It seems from php-shell.
You can use maldet for search this php-shell - https://www.rfxn.com/projects/linux-malware-detect/

i am in single user mode now because the hosting company has it blocked
and i did run maldet
didnt find anything
can i see usage per account somewhere ?

RogerVer wrote:i am in single user mode now because the hosting company has it blocked
didnt find anything
can i see usage per account somewhere ?

But you have root access and can see mail queue? If so, then you can search for spam script and delete it.

Use mailq for see your mail queue.

exim -Mvh message-id-from queue -- headers
exim -Mvb message-id-from queue -- body message

thank you guys
i think i found the script and have deleted it
i had to mount the disk
then to go spool/exim/
and read through the files ( over 18K file s)

rebooted and watching it now