On 2017-06-13 04:28:39 (-0400), Homer Wilson Smith <homerwsm...@lightlink.com>
wrote:
Suddenly I am find adore's mailq queue filled with spam, each having a
pickup line in the logs, but no indication where it comes from,
probably the web server as the from username is apache, but so far no
corellation between web logs and time stamp on pickup line.
Check for other processes running as the apache user. Check the crontab
of that user too.
Also firewall off any ports.
I would definitely advise taking a disk image of the machine for
forensic analysis and then doing a clean reinstall.
Philip
--
Philip Paeps
Senior Reality Engineer
Ministry of Information
