server Busy - IS EXIM HACKED ?

[mahdionline]

Hi
our server from 3 day ago become very busy. I see in whm that exim -q is the top(heavy) process in system.

I think someone use our mail server to send mail or . . .

I shutdown EXIM by service Exim stop command but after a few time i see exim started. then I rename the usr/sbin/exim , and see returned to normal situation.

What should i do for this problem ? Is this a DOS attack ?

Regard

[MN-Robert]

Probably a script was compromised, have a look at the logs it will tell you where the mail is coming from.

[mahdionline]

Probably a script was compromised, have a look at the logs it will tell you where the mail is coming from.

How can i detect and find this script and it's owner (Account) ?

Regard

[MN-Robert]

tail -f /var/log/exim_mainlog

or if you know what the spam is

grep spam /var/log/exim_mainlog

or higher a system admin.

[chirpy]

Yup. Enabling some extended exim logging might help you track down the offending script if they're coming from the nobody account.