spam bot

How can I block this spambot from sending mail? How to find the script causing this?

 

First try to have a look in the mail queue:

Code:

$> mailq

There you get a list of all mails currently sent or deferred.
In front of all entries you get a mail id like

Code:

8110058180C*

(the asterisk marks mails currently "active")

You now can view the mail's source code with postcat

Code:

$> postcat /var/spool/postfix/deferred/8/8110058180C

or if it has an asterisk et the end

Code:

$> postcat /var/spool/postfix/active/8110058180C

Look at the parts of the email having "From" or "received from" and search vor something like "www-data" or "X-PHP-Script" or "authenticated sender" etc. in the lines before the mail contents.

 

Tnx this will help me a lot!