SPAM coming from our server?

[coalescefl]

Hello,

Recently I've noticed a spike in SPAM coming into our mailboxes. Checking the Mail statistics in WHM, one of our clients has a massive spike in outgoing mail coming from their domain.

Is it possible that maybe a client downloaded a worm or something that somehow is sending E-mail to all the E-mail accounts on our server?

Also is there a way to view all the outgoing messages from the server?

Thank you !!!

 

[dalem]

tail -f /var/log/exim_mainlog

if you want to view what a specific user has been sending or receiving


grep username /var/log/exim_mainlog

 

[coalescefl]

thanks dalem, I'll give this shot!

 

[Ferdinant]

We did installed the php mail header patch. This gives you the ability to track down the location of the sending script if spam has been send by a vulnerable mail(form) script.

You can find the patch here

Hope that helps...

 

[Rafaelfpviana]

We did installed the php mail header patch. This gives you the ability to track down the location of the sending script if spam has been send by a vulnerable mail(form) script.

You can find the patch here

Hope that helps...

Now that looks interesting, i'm going to check that out.

Thanks for the tip