Although it's blocked from sending at the firewall, our attempts to
disable this particular exploit haven't been successful. It just keeps
running and running, and we can't seem to figure out how to disable it
completely. We could shut off sendmail, but that would cause more
headaches since that's what Apache uses on this server with our forms.

Has anyone ran into something like this? It's pretty frustrating. We
can't figure out how it got on there to begin with, and so far, all we
can do is block what it's trying to send out (as of this writing,
today, was 60,000+ spam, which our firewall has blocked all of).

Thanks in advance.