SPAM being sent from the apache user

[suhailc]

Hi,

Seems like I have some SPAM being sent out from one server, and the logs show this:

2007-10-22 15:48:24 1IjzVw-000Mjt-Vv <= [email protected] U=apache P=local S=2886 T=
"RELEASE OF YOUR PAYMENT::MAV/NNPC/FGN/UN-I.M.F" from <[email protected]> for [email protected]
2007-10-22 15:48:25 1IjzVx-000Mjx-0R <= [email protected] U=apache P=local S=2886 T=
"RELEASE OF YOUR PAYMENT::MAV/NNPC/FGN/UN-I.M.F" from <[email protected]> for [email protected]
2007-10-22 15:48:25 1IjzVx-000Mk2-1H <= [email protected] U=apache P=local S=2890 T=
"RELEASE OF YOUR PAYMENT::MAV/NNPC/FGN/UN-I.M.F" from <[email protected]> for [email protected]
2007-10-22 15:48:25 1IjzVx-000Mk6-25 <= [email protected] U=apache P=local S=2892 T=
"RELEASE OF YOUR PAYMENT::MAV/NNPC/FGN/UN-I.M.F" from <[email protected]> for [email protected]

However headers provide no information about the account/location from where the SPAM is coming from, just that it's being sent from "apache" user.

Can anyone please advise me as to how to proceed tracking the culprit down here?

Regards,
Suhail.

 

[smtalk]

Just use this patch for PHP: http://choon.net/php-mail-header.php.

 

[jlounds]

Has anyone compiled this successfully in to Direct Admin "custombuild"?

If so, I would love some step-by-step instructions. I am trying to track down what script is spamming people! Ugh.

Thank you!

Jeremy

 

[smtalk]

It's patched by default now If you want to turn it off, just set mail-header-patch to "no" in your options.conf and run "./build php n".