SPAM being sent from the apache user

suhailc

Verified User
Joined
Oct 4, 2004
Messages
119
Hi,

Seems like I have some SPAM being sent out from one server, and the logs show this:

2007-10-22 15:48:24 1IjzVw-000Mjt-Vv <= apache@server3.domain.info U=apache P=local S=2886 T=
"RELEASE OF YOUR PAYMENT::MAV/NNPC/FGN/UN-I.M.F" from <apache@server3.domain.info> for 1@yahoo.ca
2007-10-22 15:48:25 1IjzVx-000Mjx-0R <= apache@server3.domain.info U=apache P=local S=2886 T=
"RELEASE OF YOUR PAYMENT::MAV/NNPC/FGN/UN-I.M.F" from <apache@server3.domain.info> for 2@yahoo.com
2007-10-22 15:48:25 1IjzVx-000Mk2-1H <= apache@server3.domain.info U=apache P=local S=2890 T=
"RELEASE OF YOUR PAYMENT::MAV/NNPC/FGN/UN-I.M.F" from <apache@server3.domain.info> for 3@yahoo.com
2007-10-22 15:48:25 1IjzVx-000Mk6-25 <= apache@server3.domain.info U=apache P=local S=2892 T=
"RELEASE OF YOUR PAYMENT::MAV/NNPC/FGN/UN-I.M.F" from <apache@server3.domain.info> for 4@yahoo.com

However headers provide no information about the account/location from where the SPAM is coming from, just that it's being sent from "apache" user.

Can anyone please advise me as to how to proceed tracking the culprit down here?

Regards,
Suhail.
 

jlounds

Verified User
Joined
Mar 11, 2008
Messages
28
Has anyone compiled this successfully in to Direct Admin "custombuild"?

If so, I would love some step-by-step instructions. I am trying to track down what script is spamming people! Ugh.

Thank you!

Jeremy
 

smtalk

Administrator
Staff member
Joined
Aug 22, 2006
Messages
9,305
Location
LT, EU
It's patched by default now :) If you want to turn it off, just set mail-header-patch to "no" in your options.conf and run "./build php n".
 
Top