Help - Many SPAM- lfd on server5.my-server.net: LOCALHOSTRELAY Alert for 127.0.0.1

[jonyzinho]

Hi,

I need some help with urgency, because I have one client with send thousand's of mail SPAM.

I receive by mail, this report's:

==================================================

Time: Wed Aug 19 17:00:46 2009 +0100
Type: LOCALHOSTRELAY, localhost - 127.0.0.1
Count: 101 emails relayed
Blocked: No

Sample of the first 10 emails:

2009-08-19 16:55:51 1MdnVv-0000mU-SE <= kevsharp@btinternet.com H=localhost (my-server.net) [127.0.0.1] P=smtp S=1179 id=01CA20E5.17E414F1@my-server.net T="Why spend more?"
2009-08-19 16:55:51 1MdnVv-0000mh-Si <= frankallred@yahoo.com H=localhost (my-server.net) [127.0.0.1] P=smtp S=1095 id=01CA20E5.485B1CAE@my-server.net T="Ancient secret for perfect intimate life."
2009-08-19 16:55:51 1MdnVv-0000mg-T5 <= frankallred@yahoo.com H=localhost (my-server.net) [127.0.0.1] P=smtp S=1218 id=01CA20E5.2961136C@my-server.net T="New collection of Ed med discounts"

==================================================

You may help me please, to stop this thousand's of SPAM mails ?

Regards,

Joao

PS - sorry with my english.

[electron33]

I got that too just a few minutes ago with exactly the same count:

Time: Fri Aug 28 14:56:10 2009 +0100
Type: LOCALHOSTRELAY, localhost - 127.0.0.1
Count: 101 emails relayed
Blocked: No

[Infopro]

Those emails are from LFD, a part of CSF.

mailman localhostrelay alert for 127.0.0.1 - ConfigServer Scripts Forum

[electron33]

Thanks. Are these emails actually being sent out, or they're just 'false positives'?

[Infopro]

Thanks. Are these emails actually being sent out, or they're just 'false positives'?

They are not false positives. You really would have better luck on the CSF forums with chirpy the developer of CSF.

[SoftDux]

Does anyone know how to stop this?

I mean, is there actually a script, or something / someone on the server that is spamming other people using the server?

Looking at the error log,

2009-12-05 08:01:15 1NGnhh-0003RI-BI <= promote-ad@gumtree.co.za H=localhost (mercury) [127.0.0.1] P=esmtp S=10787 id=1377194518.397551259992871199.JavaMail.root@kj-batchweb002.intern.kijiji.com T="Reminder: Bump Up your Ad now!"
2009-12-05 08:01:19 1NGnhm-0003Sd-GN <= 0-0-0-0-cbouysset@microapp.com H=localhost (mercury) [127.0.0.1] P=esmtp S=2496 id=8447742977.OW3CZVC2049301@qiwrcnrywlukp.mdgtuiklddroogj.org T="[ SPAM ] Lose your weight and become more energized!"
2009-12-05 08:01:31 1NGnhy-0003WB-K2 <= 0-84199264@bounce.earthlink.net H=localhost (mercury) [127.0.0.1] P=esmtp S=3514 id=8134763668.5FMBN467086746@wsnrxxfib.cbnjol.org T="[ SPAM ] You have great chances to win!"
2009-12-05 08:01:52 1NGniG-0003XD-Ib <= 0-ncom.br@returns.groups.yahoo.com H=localhost (mercury) [127.0.0.1] P=esmtp S=3048 id=9759028018.W9MYS87G689524@xvcycte.gqoiszigg.org T="[ SPAM ] You have great chances to win!"
2009-12-05 08:02:25 1NGnim-0003aP-Pd <= snakemhoaal@hushmail.com H=localhost (mercury) [127.0.0.1] P=esmtp S=4123 id=BBB42149.73C8C150@hushmail.com T="[ SPAM ] Start earning minutes from NOW!"
2009-12-05 08:02:51 1NGnjG-0003bo-Te <= 0-yts@icicibank.com H=localhost (mercury) [127.0.0.1] P=esmtp S=2387 id=0451956558.ENW061LV516275@szevzwewomsyilc.knpkoejftjmb.va T="[ SPAM ] Detoxify while growing slim!"
2009-12-05 08:04:19 1NGnkh-0003mC-AE <= shuveb@k7computing.com H=localhost (mercury) [127.0.0.1] P=esmtp S=2908 id=a15a6277729d32c2010f5f5e43d6f8c6-m1735@k7computing.com T="Topic reply: management server crashed - how can I recover the VM's?"
2009-12-05 08:04:31 1NGnks-0003mj-SO <= 0-slin.bozdoc@gsk.com H=localhost (mercury) [127.0.0.1] P=esmtp S=3452 id=3600197326.SH0VHKL8899732@wrvktvz.gkudmt.ru T="[ SPAM ] #1 gamblers choice online casino."
2009-12-05 08:04:36 1NGnky-0003nA-1a <= schaeferYq@911tabs.com H=localhost (mercury) [127.0.0.1] P=esmtp S=7048 id=003e01ca75b3$93f7d950$bbe78bf0$@com T="[ SPAM ] Top-quality branded watches at up at 55% off - visit our website now"
2009-12-05 08:04:41 1NGnl2-0003no-TI <= nick@defyinggravity.com H=localhost (mercury) [127.0.0.1] P=esmtp S=3187 T="[ SPAM ] Special offer nick@defyinggravity.com receive 70% OFF on Pfizer."

I can clearly see that SPAM is being sent and would really like to stop that altogether.