Re: [cobalt-users] severe problem

[Glenn Parsons <gparsons@xxxxxxxxxxxxx>]

At 05:05 PM 7/11/02 -0500, you wrote:
> Any help would greatly be appreciated!  We have an emergency problem that 
> I would appreciate any assistance in fixing.  A user account on the system 
> is the user associated with a mass amount of spam email going out.  He 
> isn't even logged into the system and I know for a fact he didn't sent 
> this stuff out.  I've tried to clear the mail queue and shut down sendmail 
> for a while, but then all of a sudden the emails will be back filling up 
> the queue again.  I've got ssh running on the box and the account they 
> used doesn't have any admin priv.  Any advice or suggestions????
>
> Ciao
> Randy

Randy,

Do you know if any user is running a formmail.pl script. It sounds like 
someone is using a relay through a formmail script.

From a shell prompt do:

# locate formmail.pl

If you turn up just one, that is probably your culprit.

By the time you get this, others will have told you the same thing and told 
you how to cleanup.

Cheers,
Glenn