find $var/Maildir/cur/ -type f -mtime +$DAYSOLD -exec $COMMAND {} \;
find $var/Maildir/.Sent/ -type f -mtime +$DAYSOLD -exec $COMMAND {} \;
find $var/Maildir/.Trash/ -type f -mtime +$DAYSOLD -exec $COMMAND {} \;

There should be only one space after ‘$COMMAND’ and then the brackets and then a ‘\’ before the semi-colon. If you don’t have it your script will produce an argument error.

Food for thought.

Cheers

What about this:

ps aux 7184

Where “7184″ is the PID of the rogue perl script. According to your results.

-Andrew G

netstat -na | grep “ESTABLISHED”

I get and no mention of 6667

[root@cis-secure ~]# netstat -na | grep “ESTABLISHED”
tcp 0 0 65.44.220.71:993 107.10.100.129:49181 ESTABLISHED
tcp 0 0 65.44.220.71:143 174.252.193.58:3443 ESTABLISHED
tcp 0 44 65.44.220.71:22 71.84.230.166:4657 ESTABLISHED
tcp 0 0 65.44.220.71:143 174.253.132.110:5158 ESTABLISHED
tcp 0 0 65.44.220.71:143 174.253.132.110:5182 ESTABLISHED
tcp 0 0 65.44.220.71:110 174.255.48.10:5252 ESTABLISHED
udp 0 0 127.0.0.1:39144 127.0.0.1:39144 ESTABLISHED

If I still type

lsof -Pnl +M -i4 | grep 6667

I get

perl 7184 48 90u IPv4 606254218 TCP 65.44.220.71:58963->38.108.80.105:6667 (SYN_SENT)

I have 38.108.80.105 blocked in the firewall.

Following your suggestions I type ps aux 3959 and I get an atire list of ps lines, not one isolated line.

Included in the total output is:

7174 ? Z 0:00 [sh]
7184 ? S 0:00 /usr/sbin/apache/log

and lsof -p leads me nowhere. If I restart httpd port 80 is taken over completely and only a restart clears it.

Regards,
Tony