How to find out which process is connected to port 25?

Question

linux

Greetings. Costs EXIM (sendmail stood before). In general, pret spam from the localhost.
Here's what's in the queue message headers:
......
-host_address 127.0.0.1.42120
-received_protocol esmtps
......
268P Received: from localhost ([127.0.0.1]:42120 helo=mysite.ru)
by myhostname .ru with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
Some process sends letters through port 25 of the localhost.
How to calculate it? I can say for sure that this is not a php script.
Thank you.

Answer 1

sudo netstat -tanp | grep :25

Answer 2

It didn't work with EXIM, but maybe this way www.inmotionhosting.com/support/email/exim/find-sp... will help you find the source of the problem

Answer 3

and it's definitely not php?
just if it's not php - then you've been hacked! and that's even worse! here it's simple - we'll clean up the scripts!

Answer 4

If the connection is not permanent, run tcpdump and listen on port 25.