On 11/11/09 7:55 AM, "/dev/rob0" <r...@gmx.co.uk> wrote:

> "Senders by message count" is ENVELOPE SENDER, in the case of spam,
> completely useless. If the OP has, as I might guess, a compromised
> httpd + PHP script, for example, the envelope sender will probably
> change for EACH spam it sends.
/bin/ps ax -eostate,pid,ppid --sort=state 2>/dev/null | grep ^Z
Reveals
Z  1401  2952
Z 11675  2952
Z 20155  2952
Z 27079  2952
And ps aux | grep *then the pid #" reveals:
500       1401  0.0  0.0      0     0 ?        Z    07:09   0:00
[freshclam]<defunct>
root     18209  0.0  0.0   4048   688 pts/0    R+   09:29   0:00 grep 1401
All of these pid's are defunct freshclam zombies, it appears.


Reply via email to