[rosbif]

Thanks Nano, nothing attached - can I use the file from CVS? Will those close the 'hole' my host was referring to?

[NanoCaiordo]

You should now be able to download the file.

No, it wont get rid of the problem.
It will include a custom header in all outgoing emails
"X-DF-MailerSRC: FileUsedToSendMail for IpAddress"

When u receive a bounced email, check for this header in the mail message source and you will know which file is abused.
No need to guess anymore. Straight to the source of the issue.

At this stage you will know what you need to disable/change.

[rosbif]

Thanks Nano - I'll keep an eye. My host banned the IP that 'appeared' to be sending the emails (and the email adresses got all the way to az**@*.*) and they appear to have stopped for now.

[Dizfunkshunal]

they have stopped lol because you removed the Tell a friend option.

[NanoCaiordo]

They have stopped because you removed Tell a Friend module and or the IP was banned but the patch will still help you in case some other module use a similar function.

[macavity]

rosbif,

Just came across this thread. I encountered exactly the same problem on the 17th of December (disabled the module to deal with at that time). Interestingly the site in question was very much along the same lines as yours as far as subject matter is concerned - just a coincidence I guess!

[rosbif]

Could be - seemed like a determined attack to me at the time!