Help finding a spammer on my server

I have a spammer on one of my linux/cpanel servers using a php script to send out spam and I'm not having much luck finding him. I cought a process while he was sending out spam that looked like this:

27265 nobody 0 0.0 0.0 php-qgo.phpD01.TXTRevistAbril.htm

The file name matched the content of the spam, so I'm certain this is the spam sending script/file.

I have tried to locate the above file doing various substring searches but I couldn't find it. I also grepped a bunch of log files (access_log, error_log, etc) and again came up empty.

Anyone have any ideas/tips how to locate this guy?

 

 

 

 

Top