Spamer !

[maxhost]

hi all,
we had some spam complains that comes from an account on our server. Client say he never sent this e-mail.
Now, prob. somone use our/his SMTP server to send e-mail trought that account ( of course we have disable exim on that server)

But, is there a way to know wich account has spamed around ??
Are there some log (exept: /var/log ) ???


Thank's

 

[maxhost]

No news about this????
Anybody can give me a tip??????

thanks

 

[parag]

hi maxhost

hi maxhost

you must be having some old formmail scripts installed on your clients site.

the old version of formmail can be utilised to spam.. what i suggest you to do is.

first get the latest version of formmail from the following url

http://www.worldwidemart.com/scripts/formmail.shtml

plus you should enable suexec option from your WHM -
if you do not have suexec enabled then the headers of the submited form using formmail script will look something like this

------------------------------------------------------------------------------Return-path: &[email protected]&
Envelope-to: [email protected]
Delivery-date: Wed, 03 Apr 2002 13:32:46 +0530
Received: from nobody by host.server.com with local (Exim 3.35 #1)
id 16sfjC-00063H-00
for [email protected]; Wed, 03 Apr 2002 13:32:46 +0530
To: [email protected]
From: [email protected] ()
Subject: Formmail Submission Subject
Message-Id: &[email protected]&
Date: Wed, 03 Apr 2002 13:32:46 +0530
------------------------------------------------------------------------------

once you enable suexec the headers will change and you will exactly know which domain has an old formmail script

after enabling suexec the return path will be [email protected]


if you want more help you can contact me on
icq : 17664324
msn : [email protected]
yahoo : princeofbaroda

best regards,
Parag

 

[maxhost]

thank you parag