Problem with spammer getting into the tmp dir
So ive got a spammer getting perl scripts into the /tmp/ dir.The directory is secured, however he is still getting it in.
im running commands like
cd /usr/local/apache/domlogs/
grep "enviador.txt" ./* | more
to search for what script has the vulnerability, but searches are comming up empty.
Any idea where I should search next to see which script hes getting into tmp via?