The FormMail exploit happened to us last week. A review of the [raq3] /var/log/maillog shows the excessive activity. A review of /home/log/httpd/access will reveal if the formail exploit is being used. Also check out the messages sitting in /home/spool/mail/mqueue yet to be delivered. We had thousands of spam messages sitting in there.
With my SMTP not responding problem, I did a locate on formmail.cgi and .pl (with all sorts of variations on caps, ie: FormMail, etc., and didn't find it on my RAQ3. Any other names it can go by? Is there a way to specify wildcards in a locate command, ie: *.cgi or *.pl - I did some tests but it did not do what I hoped it would.
I know what cgi and pl my users are allowed to have, so I'd like to see a list of all of them to scrutinize.
Thanks (didn't I say that already?) Jale