Problem with spammer getting into the tmp dir

So ive got a spammer getting perl scripts into the /tmp/ dir.

The directory is secured, however he is still getting it in.

im running commands like

cd /usr/local/apache/domlogs/
grep "enviador.txt" ./* | more

to search for what script has the vulnerability, but searches are comming up empty.

Any idea where I should search next to see which script hes getting into tmp via?

 

 

 

 

Top