When I do a ps -ef .. I see:
qmaeilr 27784 15637 0 19:24 ? 00:00:00 qmail-remote hotmail.com greeiritva@gascue.com butchmoore54@hotmail.com
qmailr 27857 15637 0 19:29 ? 00:00:00 qmail-remote hotmail.com wwwContactRealtorsco@bounce.resultsmail.com butchmoore54@hotm

Can you tell me what exactly is happening here.

Thanks

Nobody has an explanation on what the ps -ef command is showing. Everybody is in the dark like me?

I am mainly worried if somebody is trying to do something they are not suppose to.

Thanks

The problem is the wording of your initial question texasweb. Nobody can tell you exactly what's happening because there was not enough information included. All the ps -ef is telling you is that qmail is trying to send an email to those remote email addresses.

Whether you have an open relay someone is exploiting, or whether there's a script somewhere on your server that is easily compromised is impossible to say without a lot more information.

What do you see in your mailqueue? Have you looked into this? You may want to install qmHandle to make it easier to look at what's going on.

Also, in the Plesk control panel do you have 127.0.0.1/8 white listed? Lots of threads around here about that one. The default /8 subnet mask leaves your server running an open relay, no matter what else you have set. You'll definitely want the white listed address to be 127.0.0.1/32 instead.

There are several other threads that'll help you to track down open relays and spammers using your server. You'll want to read them.

Thanks for the reply. I have the ip listed correctly, I did this sometime ago after my server did get compromised. I am running rkhunter daily also. I will look into the other package. The last item on the ps -ef is the redirect address email of someone on my server. I guess they were getting junk mail sent to them. I was just worried somebody was trying to do something.

Again, thanks for the input Squire, muchly appreciated.

Wayne Stevens.