спамер

[Лукашенко Константин]

NW 5.0, BM 3.5, netmail31. Есть подозрения на то, что в сети какой-то спамер появился. Mailcon показывает большое количество входящих-исходящих писем. Как вычислить компьютер-заразу?

[Мещеряков Андрей]

А при чем тут БМ? Неужели пользуете mail proxy?

[Лукашенко Константин]

Использую Novell Netmail. BM можно было не указывать в списке.

[v13]

Я в такой ситуации на юниксе включал tcpdump на исходящем интерфейсе и смотрел откуда гадость идёт.
В вашей ситуации или поставить хаб и смотреть пролетающий трафик или вытаскивать информацию из логов.
Хотя можно ещё попробовать pktscan.nlm, но его возможности ограничены.

[Иван Левшин aka Ivan L.]

Mailcon не показывает - откуда оно идет? В логах вообще что есть?

[Лукашенко Константин]

Статистика такова (см.ниже). За два часа почти 300 сообщений. Бывает больше. Не могли бы расшифровать (пояснить) строки-колонки в этой таблице?
------------------------------------------------------------------¬-
-¦ Server Statistic Details ¦-
-+----------------------------------------------------------------+-
-¦ local remote per/s ¦-
-¦ Messages queued: 16 ¦-
-¦ Messages received: 0 167 0.02 ¦-
-¦ Messages delivered: 284 52 0.04 ¦-
-¦ Messages failed: 0 1 0.00 ¦-
-¦ Recipients: 284 53 0.04 ¦-
-¦ KBytes received: 0 15 500 2.05 ¦-
-¦ KBytes delivered: 24 192 9 459 4.46 ¦-
-¦ ¦-
-¦ curr. total per/s ¦-
-¦ Client connections: 0 633 0.08 ¦-
-¦ Server connections: 0 320 0.04 ¦-
-¦ Outg. connections: 0 151 0.02 ¦-
-¦ ¦-
-¦ Wrong passwords: 2 Timer ¦-
-¦ Unauthorized NMAP: 0 0d 02h 05m 38s ¦-
-L------------------------------------------------------------------

[Доменика]

NW 5.0, BM 3.5, netmail31. Есть подозрения на то, что в сети какой-то спамер появился. Mailcon показывает большое количество входящих-исходящих писем. Как вычислить компьютер-заразу?

Во первых включаем и смотрим лог.
Во вторых смотрим что у Вас в SMTP Agent: UBE Relaying
Что установленно?
Пробуем сразу ограничить отправку на несколько адресов за один раз.

Смотрим результат.

[Лукашенко Константин]

В UBE Relaying стоят галки Only Allow Remote Sending for Authenticated Users и Require Sender to Be in Allowed List for Remote Sending (в диапазоне адресов указан внутренний IP сервера).
Maximum Number of Recipients per Email равно 10.
Лог включен. Вот кусок, и что-то мне там не нравится.
Site.kz - мой домен. 212.10.10.22 - внешний адрес сервера.

Apr 01 11:47:08 NMAP:[2083] [006-7ebac83].ProcessQueueEntry()
Apr 01 11:47:08 NMAP:[2617] [006-7ebac83] ProcessQueueEntry(): Unknown entry:D1207032428
Apr 01 11:47:08 NMAP:[2350] [006-7ebac83] ProcessQueueEntry(): From:market@site.kz/AuthFrom:Novikova
Apr 01 11:47:08 NMAP:[2617] [006-7ebac83] ProcessQueueEntry(): Unknown entry:X1
Apr 01 11:47:08 NMAP:[2603] [006-7ebac83] ProcessQueueEntry(): Remote to:kmg80@yandex.ru kmg80@yandex.ru 12
Apr 01 11:47:08 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [6-7ebac83].
Apr 01 11:47:08 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1031 for entry [6-7ebac83].
Apr 01 11:47:08 PlusPack:[0448][006-7ebac83] HandleConnection() from 100007f
Apr 01 11:47:08 NMAP:[2083] [007-7ebac83].ProcessQueueEntry()
Apr 01 11:47:08 NMAP:[2617] [007-7ebac83] ProcessQueueEntry(): Unknown entry:D1207032428
Apr 01 11:47:08 NMAP:[2350] [007-7ebac83] ProcessQueueEntry(): From:market@site.kz/AuthFrom:Novikova
Apr 01 11:47:08 NMAP:[2617] [007-7ebac83] ProcessQueueEntry(): Unknown entry:X1
Apr 01 11:47:08 NMAP:[2503] [007-7ebac83] ProcessQueueEntry(): To:mail/INBOX
Apr 01 11:47:08 NMAP:Delivering message from market@site.kz for mail
Apr 01 11:47:08 NMAP:Storing msg from market@site.kz in mail/INBOX [SCMS:0]
Apr 01 11:47:08 NMAP:[2603] [007-7ebac83] ProcessQueueEntry(): Remote to:kmg80@yandex.ru kmg80@yandex.ru 12
Apr 01 11:47:08 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7ebac83].
Apr 01 11:47:10 NMAP:[2083] [007-7EBA92F].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2617] [007-7EBA92F] ProcessQueueEntry(): Unknown entry:D1206978751
Apr 01 11:47:10 NMAP:[2350] [007-7EBA92F] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA92F] ProcessQueueEntry(): Remote to:jqyay@travelgolf.com jqyay@travelgolf.com 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA92F].
Apr 01 11:47:10 NMAP:[2083] [007-7EBA3E3].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2083] [007-7EBA924].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2083] [007-7EBA9A3].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2083] [007-7EBA5BC].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2083] [007-7EBA7F0].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2083] [007-7EBA39C].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2083] [007-7EBA974].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2617] [007-7EBA3E3] ProcessQueueEntry(): Unknown entry:D1206898612
Apr 01 11:47:10 NMAP:[2350] [007-7EBA3E3] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA3E3] ProcessQueueEntry(): Remote to:MaryellenscatEarl@foxbusiness.com MaryellenscatEarl@foxbusiness.com 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA3E3].
Apr 01 11:47:10 NMAP:[2617] [007-7EBA924] ProcessQueueEntry(): Unknown entry:D1206978662
Apr 01 11:47:10 NMAP:[2350] [007-7EBA924] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA924] ProcessQueueEntry(): Remote to:jqyay@travelgolf.com jqyay@travelgolf.com 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA924].
Apr 01 11:47:10 NMAP:[2617] [007-7EBA9A3] ProcessQueueEntry(): Unknown entry:D1206987450
Apr 01 11:47:10 NMAP:[2350] [007-7EBA9A3] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA9A3] ProcessQueueEntry(): Remote to:ursulacrain@autoliike.com ursulacrain@autoliike.com 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA9A3].
Apr 01 11:47:10 NMAP:[2617] [007-7EBA5BC] ProcessQueueEntry(): Unknown entry:D1206942421
Apr 01 11:47:10 NMAP:[2350] [007-7EBA5BC] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA5BC] ProcessQueueEntry(): Remote to:HyeJun-tdyljh@safinel.com HyeJun-tdyljh@safinel.com 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA5BC].
Apr 01 11:47:10 NMAP:[2083] [007-7EBA3D1].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2617] [007-7EBA3D1] ProcessQueueEntry(): Unknown entry:D1206896567
Apr 01 11:47:10 NMAP:[2350] [007-7EBA3D1] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA3D1] ProcessQueueEntry(): Remote to:AraceliyugoslaviaGeiger@merriam-webster.com AraceliyugoslaviaGeiger@merriam-webster.com 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA3D1].
Apr 01 11:47:10 NMAP:[2083] [007-7EBA99D].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2083] [007-7EBAA80].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2617] [007-7EBAA80] ProcessQueueEntry(): Unknown entry:D1207001719
Apr 01 11:47:10 NMAP:[2350] [007-7EBAA80] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBAA80] ProcessQueueEntry(): Remote to:info@gilv.ru info@gilv.ru 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBAA80].
Apr 01 11:47:10 NMAP:[2083] [007-7EBA9B4].ProcessQueueEntry()
Apr 01 11:47:10 NMAP:[2617] [007-7EBA7F0] ProcessQueueEntry(): Unknown entry:D1206962965
Apr 01 11:47:10 NMAP:[2350] [007-7EBA7F0] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA7F0] ProcessQueueEntry(): Remote to:sale@qppc.ru sale@qppc.ru 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA7F0].
Apr 01 11:47:10 NMAP:[2617] [007-7EBA39C] ProcessQueueEntry(): Unknown entry:D1206890925
Apr 01 11:47:10 NMAP:[2350] [007-7EBA39C] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA39C] ProcessQueueEntry(): Remote to:station@adria-airways.at station@adria-airways.at 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA39C].
Apr 01 11:47:10 NMAP:[2617] [007-7EBA974] ProcessQueueEntry(): Unknown entry:D1206985315
Apr 01 11:47:10 NMAP:[2350] [007-7EBA974] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA974] ProcessQueueEntry(): Remote to:support@strana.kz support@strana.kz 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA974].
Apr 01 11:47:10 NMAP:[2617] [007-7EBA99D] ProcessQueueEntry(): Unknown entry:D1206987394
Apr 01 11:47:10 NMAP:[2350] [007-7EBA99D] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA99D] ProcessQueueEntry(): Remote to:ursulacrain@autoliike.com ursulacrain@autoliike.com 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA99D].
Apr 01 11:47:10 NMAP:[2617] [007-7EBA9B4] ProcessQueueEntry(): Unknown entry:D1206988015
Apr 01 11:47:10 NMAP:[2350] [007-7EBA9B4] ProcessQueueEntry(): From:-/AuthFrom:-
Apr 01 11:47:10 NMAP:[2603] [007-7EBA9B4] ProcessQueueEntry(): Remote to:ursulacrain@autoliike.com ursulacrain@autoliike.com 0
Apr 01 11:47:10 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1035 for entry [7-7EBA9B4].
Apr 01 11:47:19 SMTP:Remote delivery for market@site.kz Novikova to kmg80@yandex.ru, Size:48225, Status:250
Apr 01 11:47:19 SMTP:Remote delivery for - - to MaryellenscatEarl@foxbusiness.com, Size:2398, Status:550
Apr 01 11:47:19 SMTP:Remote delivery for - - to AraceliyugoslaviaGeiger@merriam-webster.com, Size:2096, Status:550
Apr 01 11:47:20 SMTP:Remote delivery for - - to jqyay@travelgolf.com, Size:1971, Status:450
Apr 01 11:47:20 SMTP:Remote delivery for - - to support@strana.kz, Size:1952, Status:553
Apr 01 11:47:20 SMTP:Remote delivery for - - to jqyay@travelgolf.com, Size:2311, Status:450
Apr 01 11:47:22 SMTP:Remote delivery for - - to jqyay@travelgolf.com, Size:1971, Status:450
Apr 01 11:47:22 SMTP:Remote delivery for - - to support@strana.kz, Size:1952, Status:553
Apr 01 11:47:22 SMTP:Remote delivery for - - to jqyay@travelgolf.com, Size:2311, Status:450
Apr 01 11:47:24 SMTP:[4981] Connection from 192.168.100.101
Apr 01 11:47:25 NMAP:[2083] [000-7ebac84].ProcessQueueEntry()
Apr 01 11:47:25 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1091 for entry [0-7ebac84].
Apr 01 11:47:25 NMAP:[2083] [001-7ebac84].ProcessQueueEntry()
Apr 01 11:47:25 NMAP:[2083] [002-7ebac84].ProcessQueueEntry()
Apr 01 11:47:25 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1033 for entry [2-7ebac84].
Apr 01 11:47:25 MSGAlias:[1200][002-7ebac84] HandleConnection() from 100007f
Apr 01 11:47:25 NMAP:ProcessQueueEntry(): Found client 212.10.10.22:1056 for entry [2-7ebac84].
Apr 01 11:47:25 Forward:[0592][002-7ebac84] HandleConnection() from 100007f
Apr 01 11:47:25 Forward:[849] [002-7ebac84] Keeping copy
Apr 01 11:47:25 Forward:[849] [002-7ebac84] Keeping copy
Apr 01 11:47:25 Forward:[849] [002-7ebac84] Keeping copy

[v13]

Ищи на market@site.kz (Novikova) троянов.