Tracking mailing attempts in a script

jj1111

I recently came across a CMS script which attempts to send an e-mail during installation without my permission or disclosure that it does this, what the content of the e-mail is and where is it being sent. The web site and the script documentation do not mention any e-mails being sent out as part of the installation. The attempt to send the unathorized e-mail is captured by my firewall. There are no other spyware programs on my PC, this only happens when I attempt to install this script.

I would like to know if there is a way to find what is it that the script is trying to mail and where, in othere words is there some tracing utility to step through the script and find the spyware code?

The script in question can be downloaded from here: http://www.renegade-cms.com/downloads.html

Thanks for any help on this.

planetsim

Im not going to be downloading the script but look within the install file should have something like mail(); in there. From there just work out where its trying to send it out.

jj1111

I looked for mail(); that was obviously the first thing I did, but I did not find it in the install script.

The installer calls other files and so on, that's why I am looking for a trace utility or something that avoids having to scan all the files.

I'd try a "grep" but that does not tell me if the mail() it finds is triggered down from the installer.

Are there any other calls than mail() that can send an e-mail?

The author seems to have hidden the call so it is not quite so obvious to find but I know it is there. If there was a trace utility I could get to the exact line that trips the firewall which tells me that Apache is trying to send an e-mail when I run the installer.