Re: [909linux] compromised server (located several states away)

[Roger Rustad]

"/etc/init.d/courier stop" killed it

now I type "lsof -u daemon"

and there is nothing

How might I find out what's causing it without just killing the service?