Re: [exim] Hijacked "www" user for sending out spam

"list1" <list1@???> writes:

> Hello,
>
> It seems like somebody has hijacked "www" user for sending out spam
> like there is no tomorrow. You can see a small section of my exim log
> below or a little longer at this address:
> http://www.dnsbureau.com/exim_main.log.txt I've been looking at
> various other logs for hours trying to figure out what was
> compromised, but there is absolutely no trace of activity like logins
> from authenticated or system users via smtp/imap/pop. www is a system
> account with no shell access.

What process run with this id? lamp? Maybe some hijacked that
process...

hth, Christoph