Date:  Mon, 09 Jul 2007 15:04:27 +0100
From:  D <bqlist (at mark) distortal.com>
Subject:  [coba-e:10341] Finding a Mail Script
To:  Cobalt Mailing List <coba-e (at mark) bluequartz.org>
Message-Id:  <4692406B.1050803 (at mark) distortal.com>
X-Mail-Count: 10341

Hi All,

Recently I looked into /var/log/messages and /var/log/maillog and found 
a lot of entries that look like my server is trying to send email. 
Netstat appears to show lots of http connections to mail servers and I 
am concerned that someone has uploaded an insecure mail script.

Is there any way to find out which script spawned a given message?  As 
far as I am aware there are only PHP scripts on the server, but I could 
be wrong.

Regards



DD