mailnull /usr/sbin/exim

T

t9clkclnr

Well-Known Member
Jun 11, 2004
254
0
166
Southern California
Recevied about 40K emails into the queue within 3 hours
Sent server into 96 - load. Don't know what is going on, or how to deduce

mailnull 7131 0.0 0.2 12168 5444 ? S Jan31 0:47 eximstats
mailnull 1301 0.0 0.1 8928 2136 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtD-0000Kn-JM
mailnull 1409 1.2 0.1 9736 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000Me-4j
mailnull 1412 0.0 0.1 8352 2136 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000MY-1b
mailnull 1437 0.0 0.0 8092 908 ? Ss 21:18 0:00 /usr/sbin/exim -bd -q60m
mailnull 1442 0.0 0.0 7940 856 ? Ss 21:18 0:00 /usr/sbin/exim -tls-on-connect -bd -oX 465
mailnull 1451 1.2 0.1 8288 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000Mo-8n
mailnull 1527 1.6 0.1 10080 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000Nk-Nw
mailnull 1530 3.6 0.1 9452 3920 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000O3-V3
mailnull 1539 3.0 0.1 8712 3920 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000Oh-B1
mailnull 1554 1.0 0.1 8708 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000Oo-Fp
mailnull 1564 1.3 0.1 8852 3956 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000On-EQ
mailnull 1581 1.0 0.1 9600 3956 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000PB-LV
mailnull 1584 4.0 0.1 9292 3916 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000PD-Lj
mailnull 1586 0.0 0.1 9356 2728 ? D 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000P9-Ks
mailnull 1591 3.0 0.1 9900 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000PT-Sa
mailnull 1594 2.5 0.1 10140 3956 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000PU-T6
mailnull 1604 5.0 0.1 10048 3924 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Ph-3U
mailnull 1608 3.5 0.1 9936 3916 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Pt-8A
mailnull 1610 0.0 0.1 9600 2184 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Pe-3C
mailnull 1617 3.5 0.1 9648 3920 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Q3-CR
mailnull 1620 0.0 0.1 9784 2144 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Px-9S
mailnull 1623 3.5 0.1 9648 3924 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Q6-EF
mailnull 1625 4.0 0.1 9928 3920 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QC-HS
mailnull 1633 0.0 0.1 10136 2140 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000PZ-0r
mailnull 1635 0.0 0.1 10136 2180 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000PZ-0r
mailnull 1638 0.0 0.1 9652 2144 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QE-Ig
mailnull 1642 0.0 0.1 10104 2192 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QH-K7
mailnull 1653 0.0 0.1 9656 2184 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QO-Ts
mailnull 1654 0.0 0.1 10212 2176 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000QV-6f
mailnull 1657 0.0 0.1 8304 2132 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QM-QA
mailnull 1666 0.0 0.1 8700 2180 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000QX-H6
mailnull 1667 0.0 0.1 8512 2180 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000Qh-NQ
mailnull 1669 0.0 0.1 9532 2112 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000QZ-Jg
mailnull 1674 0.0 0.1 9692 2112 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000Qm-UR
mailnull 1675 0.0 0.0 8784 1816 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000Ph-3U
mailnull 1676 0.0 0.0 8968 1812 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtH-0000PD-Lj
mailnull 1677 0.0 0.0 8112 1808 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000Pt-8A
mailnull 1680 0.0 0.0 8840 1800 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000QC-HS
mailnull 1681 0.0 0.0 8952 1804 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000Q6-EF
mailnull 1682 0.0 0.0 8464 1804 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000Q3-CR
mailnull 1683 0.0 0.0 7944 1812 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtG-0000O3-V3
mailnull 1684 0.0 0.1 10292 2096 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtK-0000Qx-51
mailnull 1685 0.0 0.1 10292 2100 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtK-0000Qx-51
mailnull 1686 0.0 0.0 9164 1752 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtH-0000Oh-B1
mailnull 1688 0.0 0.0 8100 764 ? S 21:18 0:00 /usr/sbin/exim -bd -q60m
root 1525 0.3 0.0 4504 1112 ? S 21:18 0:00 antirelayd
 
M

mohit

Well-Known Member
Jul 12, 2005
553
0
166
Sticky On Internet
hi,
most probably a BULK mailler on the box, look for the messages in Queue, whats is being relayed, who's account is originating those.

see ya,
manu
 
T

t9clkclnr

Well-Known Member
Jun 11, 2004
254
0
166
Southern California
Found it...

grep'd for the sendmail, and located someones attempt at a php mailer that was being exploited.

Server load got to 199...and was still trucking. Awesome.

anyway, cleared mail queue, restarted server and removed offensive scripts and slapped the hand of the user. (albeit a friend)...punk

Anywhos, all is good, the forums here helped, once I found the right 3 threads to view.
 
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
J Spam emails from mailnull Email 15
B Suspicious process running under user mailnull Email 4
S Mailnull 47 12 Bounce email problem... Email 2
G Prevent emails being sent as "local" or "mailnull" Email 2
M Spamming from Mailnull Email 1
Similar threads
Spam emails from mailnull
Suspicious process running under user mailnull
Mailnull 47 12 Bounce email problem...
Prevent emails being sent as "local" or "mailnull"
Spamming from Mailnull
Top Bottom