Spambot Infection Detection
- by crankshaft
My server has been blocked by CBL for participating in curtwail spambot.
Initially we suspected that it was coming from a PC and not from the server, but the router is blocking all packets on 25 except those coming from the server.
I have just executed the tcpdump command and every 5 minutes I see a flurry of activity on port 25 that is very suspicious and I am sure that there is some process running on the server:
13:02:30.027436 IP exprod5og110.obsmtp.com.53803 > ubuntu.local.smtp: Flags [S], seq 171708781, win 5744, options [mss 1436,sackOK,TS val 3046699707 ecr 0,nop,wscale 2], length 0
I have stopped postfix, and yet there is still traffic on port 25 above.
But how can I find what process is actually communicating on port 25 as it only rund for a few seconds and so for example lsof -i :25 will never catch it.
I have been working on this now for 2 days, it is a live server and I cannot simply shut it down, any suggestion on how I can detect the source of this email bot process ?