RE: [cobalt-users] severe problem

["Dan Kriwitsky" <list1@xxxxxxxxxxxxxxxxxxxx>]

> Any help would greatly be appreciated!  We have an emergency 
> problem that I would appreciate any assistance in fixing.  A 
> user account on the system is the user associated with a mass 
> amount of spam email going out.  He isn't even logged into 
> the system and I know for a fact he didn't sent this stuff 
> out.  I've tried to clear the mail queue and shut down 
> sendmail for a while, but then all of a sudden the emails 
> will be back filling up the queue again.  I've got ssh 
> running on the box and the account they used doesn't have any 
> admin priv.  Any advice or suggestions????
> 

I would look carefully at any CGI scripts they have in there and the
permissions on those. Check the access logs to match access to any
scripts to the spam.
-- 
Dan Kriwitsky

Please reply to the list only. Offlist replies are not read.