dcc

Discuss our MailScanner install script and MailScanner itself
Post Reply
wgalafassijr
Junior Member
Posts: 9
Joined: 19 Dec 2006, 19:38

dcc

Post by wgalafassijr »

Hello to all,

I'm receiving emails with subject: Suspicious process running under user nobody

The executable is: /var/dcc/libexec/dccifd

Command Line (often faked in exploits):

/var/dcc/libexec/dccifd -Inobody -tCMN,5, -llog -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID


Thanks,
Wilson
Top
Sarah
Moderator
Posts: 934
Joined: 09 Dec 2006, 22:49

Post by Sarah »

dccifd should not be running, it is not used in the default MailScanner installation unless you have altered the configuration. You can try stopping it by killing the process and then removing the binary (/var/dcc/libexec/dccifd). It seems to keep running on some servers even though it is not called by MailScanner.
Top
Post Reply

Return to “MailScanner”