ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : sergey chervyakov                    2:5020/400     28 Nov 2001  15:38:16
 To : All
 Subject : опять drweb-smf
 -------------------------------------------------------------------------------- 
 

 
 Как же все таки отловить вирус c sendmail ? ?
 
 Специально отправляя вирус на почту, смотрим логи
 #cat /var/log/maillog
 
 Nov 28 14:20:27 mail sendmail[5063]: fASBKLJ6005063:from=<ru78@ru.ru>,
 size=127603, class=0,
 nrcpts=1,msgid=<web-10371873@backend2.aha.ru>,proto=ESMTP,
 daemon=MTA,relay=bird.zenon.net [213.189.198.215]
 Nov 28 14:20:27 mail drweb-smf: header - Received:from[195.2.83.130] (HELO
 backend2.aha.ru) by frontend2.aha.ru (CommuniGate Pro SMTP 3.5b9) with ESMTP
 id 58994107 forroot@moscowjackpot.ru; Wed, 28 Nov 2001 14:20:12 +0300
 Nov 28 14:20:27 mail drweb-smf: header - Received:from[212.5.109.14]
 (account <ru78@ru.ru>) by backend2.aha.ru (CommuniGate Pro WebUser 3.5b9)
 with HTTP id 10371873 for<root@moscowjackpot.ru>; Wed, 28 Nov 2001 14:20:12
 +0300
 Nov 28 14:20:27 mail drweb-smf: header - From:"sergey"<ru78@ru.ru>
 Nov 28 14:20:27 mail drweb-smf: header - Subject:=? KOI8-R?
 Q?=D7=C9=D2=D5=D3? =
 Nov 28 14:20:27 mail drweb-smf: header -To:root@moscowjackpot.ru
 Nov 28 14:20:27 mail drweb-smf: header - X-Mailer:CommuniGatePro Web Mailer
 v.3.5b9
 Nov 28 14:20:27 mail drweb-smf: header - Date:Wed, 28 Nov 200114:20:12 +0300
 Nov 28 14:20:27 mail drweb-smf:
 header -Message-ID:<web-10371873@backend2.aha.ru>
 Nov 28 14:20:27 mail drweb-smf: header - MIME-Version:1.0
 Nov 28 14:20:27 mail drweb-smf:
 header -Content-Type:multipart/mixed;boundary="_===10371873====backend2.aha.
 ru===_"
 Nov 28 14:20:27 mail drweb-smf: end of headers section
 Nov 28 14:20:27 mail drweb-smf: message chunk - 65535 bytes
 Nov 28 14:20:27 mail drweb-smf: message chunk - 63823 bytes
 Nov 28 14:20:27 mail drweb-smf: end of message chunks
 Nov 28 14:20:27 mail drweb-smf: start scanning message from<ru78@ru.ru> ...
 Nov 28 14:20:27 mail drweb-smf: TCP sockets: connecting to127.0.0.1:3000.
 Nov 28 14:20:27 mail drweb-smf: message sent by <ru78@ru.ru> is okey.
 Nov 28 14:20:27 mail drweb-smf: processing message from<ru78@ru.ru>
 completed
 Nov 28 14:20:27 mail sendmail[5063]: fASBKLJ6005063: Milter accept: message
 Nov 28 14:20:27 mail sendmail[5066]:
 fASBKLJ6005063:to=<root@moscowjackpot.ru>, delay=00:00:04,
 xdelay=00:00:00,mailer=local, pri=157616,dsn=2.0.0, stat=Sent
 Nov 28 14:20:27 mail drweb-smf: close SMTP session
 
 Hикакого упоминания даже о вирусе..
 
 Хотя drwebdc все вроде опознает..
 [root@mail sendmail]# /opt/drweb/clients/drwebdc/drwebdc -w
 -f/home/ch/CFGWIZ32.EXE
 Daemon address is not defined, default will be used.
 Use defaults library settings: tcp/localhost:3000, timeout(0 sec
 0 msec)
 TCP sockets: call resolver for localhost
 TCP sockets: resolver return 127.0.0.1
 TCP sockets: connecting to 127.0.0.1:3000.
 Results: daemon return code 0x20 (known viruses)
 Final code 0x1.
 [root@mail sendmail]#
 
 Подскажите, что делать..
 
 Заранее большое спасибо..
 Chervyakov Sergey,
 mailto: ch@jackpot.ru
 ...
 --- ifmail v.2.15dev5
  * Origin: Jackpot Ltd (2:5020/400)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор