Results 1 to 7 of 7
Thread: SPAM - Need Help FAST - please
-
04-21-2004, 03:54 AM #1Disabled
- Join Date
- Apr 2004
- Posts
- 41
SPAM - Need Help FAST - please
Hello,
I just looked at Top Email Relayers and here is the stats
User Domain Messages Sent Total Bytes Sent
nobody 12980 79869978
cpanel 9 18146
root 2 39037
nobody has sent 12980 E-mails!!! I looked further
Time Sent Message Id Sender Destination Size in Bytes
2004-04-21 00:07:31 1BFr1t-0004vR-3 deactivation124781426@ebay.com ainecoffey@hehe.com 6152
2004-04-20 19:58:19 1BFqgg-0006K8-W deactivation124781426@ebay.com gggroup@wzrd.com 6146
2004-04-20 17:20:31 1BFrNY-0003ej-H deactivation124781426@ebay.com darsue@aeroinc.net 6150
2004-04-20 16:53:48 1BFqg1-0005pf-W deactivation124781426@ebay.com gftlgirl@go.com 6144
and there is a huge list of them... how do I stop him?
Please help.
-
04-21-2004, 03:55 AM #2Disabled
- Join Date
- Apr 2004
- Posts
- 41
If anyone has experience with this, and can do something please drop a reply, I be glad to pay...
-
04-21-2004, 04:00 AM #3Web Hosting Master
- Join Date
- Oct 2003
- Location
- Australia
- Posts
- 1,738
It will most likely be a php mailer, or an exploited php script. Usually php runs as nobody...
I suggest you get your server admin on to this ASAP.Brad Baker
XYZulu Hosting
-
04-21-2004, 04:00 AM #4Web Hosting Master
- Join Date
- Aug 2000
- Posts
- 2,754
look for a formmail script:
locate *orm*ail.*
that will bring back any formmail scripts running.
-
04-21-2004, 04:10 AM #5Disabled
- Join Date
- Apr 2004
- Posts
- 41
damn, I can't believe he already sent 12980 since this morning... seems he was using FormMail which I just disabled.
any ideas if i'm in the SPAM list already?
-
04-21-2004, 04:18 AM #6Disabled
- Join Date
- Apr 2004
- Posts
- 41
btw, there is a usefull option in WHM which I never noticed before:
Prevent the user 'nobody' from sending out mail to remote addresses (php and cgi scripts generally run as nobody if you are not using phpsuexec and suexec respectively.)
ok, so do you guys have this checked? what happens to the PHP scripts?
-
04-21-2004, 07:29 AM #7Web Hosting Master
- Join Date
- Aug 2003
- Location
- Twin Cities Area
- Posts
- 5,649
if you enable that, i hear there is big trouble!
besides, he is your client, right?if you haven't considered chapter 7 bankruptcy, maybe you should.
eliminate your debt, keep the property you want, most people qualify.
contrary to popular belief - no attorney is necessary!