Could be formmail.pl, if you are using it. Old Versions can be abused to send Spam. There's some scanners looking for it, too. Latest Version is 1.9, which allows you to specify the recipients and therefore prevents spam. You can get it at Matt's Script Archive: http://worldwidemart.com/scripts/ Of course, it could be any other Script sending Email, if not properly secured. You should scan your machine for forms sending Email. Mit freundlichen Grüßen, Roman Dörr Systemtechniker Tel. +49 30 767151-14 -- tro:net GmbH Berlin Network & New Media Solutions Raumerstr. 22 10437 Berlin Tel. +49 30 767151-0 Fax +49 30 767151-13 Web www.tro.net -----Ursprüngliche Nachricht----- Von: Delia Wakelin [mailto:d.wakelin@unn.ac.uk] Gesendet: Donnerstag, 24. Januar 2002 09:12 An: suse-security@suse.com Betreff: [suse-security] spam - acting as a relay I have recently been informed that my machine is relaying spam. Need some help to identify the problem. I have had sendmail switched off on a suse 7.3 machine. here is the gist of the problem - my machine aaa.bbb.cc.dd. It seems they are using wwwrun - does that mean it is via php? Where and how should I block this