[求助]怎么查出局域几哪部机在发病毒邮件？

cove 发表于 2004-5-12 10:17:57

也许不该在这里提问的^_^ 
 
从Imail的记录文件里可以查出一个IP在发病毒邮件，而刚好这个IP是我自己的局域的IP。现在的问题是怎么查出是哪部机在发病毒邮件？用什么软件？

cloudx 发表于 2004-5-12 11:04:27

Re:[求助]怎么查出局域几哪部机在发病毒邮件？

你怎么查到的？把你的日志文件帖出来看看？

badwrs2000 发表于 2004-5-12 16:19:18

Re:[求助]怎么查出局域几哪部机在发病毒邮件？

你都知道是自己的局域的IP，还不知道是哪部机器？？

cove 发表于 2004-5-12 18:04:36

Re:[求助]怎么查出局域几哪部机在发病毒邮件？

20040510 060508 127.0.0.1 SMTPD (0027012C) MAIL FROM:<webmaster@****.com> 
20040510 060508 127.0.0.1 SMTPD (0027012C) RCPT TO:<huili5198@sina.com> 
20040510 060508 127.0.0.1 SMTPD (0027012C) d:\IMail\spool\Dab140027012c8553.SMD 1285 
20040510 060508 127.0.0.1 SMTPD (0027012C) performing antispam checks 
20040510 060942 127.0.0.1 SMTPD (0028012C) connect 61.157.139.230 port 37015 
20040510 060942 127.0.0.1 SMTPD (0028012C) EHLO ****.com 
20040510 060942 127.0.0.1 SMTPD (0028012C) MAIL FROM:<game@****.com> 
20040510 060942 127.0.0.1 SMTPD (0028012C) RCPT TO:<webmaster@****.com> 
20040510 060942 127.0.0.1 SMTPD (0028012C) ERR ****.com invalid user <webmaster@****.com 
20040510 063233 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 87 
20040510 064816 127.0.0.1 SMTPD (0029012C) connect 61.129.59.47 port 17129 
20040510 064816 127.0.0.1 SMTPD (0029012C) HELO mx47.eachnet.com 
20040510 064816 127.0.0.1 SMTPD (0029012C) MAIL FROM:<eoi@eachnet.com> 
20040510 064816 127.0.0.1 SMTPD (0029012C) RCPT TO:<tenten@****.net> 
20040510 064816 127.0.0.1 SMTPD (0029012C) d:\IMail\spool\Db5300029012c0553.SMD 14962 
20040510 064816 127.0.0.1 SMTPD (0029012C) performing antispam checks 
20040510 064849 127.0.0.1 SMTP (0368002B) processing d:\IMail\spool\Qb5300029012c0553.SMD 
20040510 064849 127.0.0.1 SMTP (0368002B) Got White List and Content Filter for ****.com 
20040510 064849 127.0.0.1 SMTP (0368002B) in white list 
20040510 064849 127.0.0.1 SMTP (0368002B) ldeliver chencheng.net tenten-main (1) eoi@eachnet.com 14962 
20040510 064849 127.0.0.1 SMTP (0368002B) ldeliver ****.com all-main (1) eoi@eachnet.com 14962 
20040510 064849 127.0.0.1 SMTP (0368002B) finished d:\IMail\spool\Qb5300029012c0553.SMD status=1 
20040510 070234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 88 
20040510 073234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 89 
20040510 080234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 90 
20040510 083234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 91 
20040510 085531 127.0.0.1 SMTPD (002A012C) connect 61.157.139.230 port 37725 
20040510 085531 127.0.0.1 SMTPD (002A012C) EHLO ****.com 
20040510 085531 127.0.0.1 SMTPD (002A012C) MAIL FROM:<zhang98722@6.com.cn> 
20040510 085531 127.0.0.1 SMTPD (002A012C) RCPT TO:<webmaster@****.com> 
20040510 085531 127.0.0.1 SMTPD (002A012C) ERR ****.com invalid user <webmaster@****.com 
20040510 090234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 92 
SYSLOGD 8.01, Copyright ? 1994-2001, Ipswitch, Inc. 
20040510 091459 0.0.0.0:514 Server ready for action 
20040510 092915 127.0.0.1 POP3D (00000198) logon success for cove ****.com from 220.***.***.*** 
20040510 092916 127.0.0.1 POP3D (00000198) logoff for cove R:1, D:0, P:0 
20040510 092920 127.0.0.1 POP3D (00000198) logon success for cove ****.com from 220.***.***.*** 
20040510 092921 127.0.0.1 POP3D (00000198) logoff for cove R:1, D:1, P:0 
20040510 094458 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 1 
20040510 094712 127.0.0.1 SMTPD (01FF0082) connect 220.***.***.*** port 45306 
20040510 094712 127.0.0.1 SMTPD (015C00C2) connect 220.***.***.*** port 45307 
20040510 094712 127.0.0.1 SMTPD (01FF0082) EHLO ****.com 
20040510 094712 127.0.0.1 SMTPD (015C00C2) EHLO ****.com 
20040510 094712 127.0.0.1 SMTPD (01FF0082) MAIL FROM:<angie@taiwanslot.com.tw> 
20040510 094712 127.0.0.1 SMTPD (015C00C2) MAIL FROM:<sm01084@****.com> 
20040510 094712 127.0.0.1 SMTPD (01FF0082) RCPT TO:<01020@****.com> 
20040510 094712 127.0.0.1 SMTPD (01FF0082) ERR ****.com invalid user <01020@****.com 
20040510 094712 127.0.0.1 SMTPD (015C00C2) RCPT TO:<chinagame@****.com> 
20040510 094717 127.0.0.1 SMTPD (02030082) connect 220.***.***.*** port 45310 
20040510 094717 127.0.0.1 SMTPD (02030082) EHLO ****.com 
20040510 094717 127.0.0.1 SMTPD (02030082) MAIL FROM:<20040504101100.sm01060@****.com> 
20040510 094717 127.0.0.1 SMTPD (02030082) RCPT TO:<01020@****.com> 
20040510 094717 127.0.0.1 SMTPD (02030082) ERR ****.com invalid user <01020@****.com 
20040510 094717 127.0.0.1 SMTPD (02040082) connect 220.***.***.*** port 45311 
20040510 094717 127.0.0.1 SMTPD (02040082) EHLO ****.com 
20040510 094718 127.0.0.1 SMTPD (02040082) MAIL FROM:<56098832@****.com> 
20040510 094718 127.0.0.1 SMTPD (02040082) RCPT TO:<chinagame@****.com> 
20040510 094722 127.0.0.1 SMTPD (02040082) d:\IMail\spool\Ddf26020400827434.SMD 0 
20040510 094722 127.0.0.1 SMTPD (02040082) performing antispam checks 
20040510 094722 127.0.0.1 SMTPD (02040082) <****.com> BLACKLIST: connecting to service (spamhaus:*:sbl.spamhaus.org) 
20040510 094723 127.0.0.1 SMTPD (015C00C2) d:\IMail\spool\Ddf20015c00c25e2b.SMD 0 
20040510 094723 127.0.0.1 SMTPD (015C00C2) performing antispam checks 
20040510 094723 127.0.0.1 SMTPD (015C00C2) <****.com> BLACKLIST: connecting to service (spamhaus:*:sbl.spamhaus.org) 
20040510 094725 127.0.0.1 SMTPD (015D00C2) connect 220.***.***.*** port 45317 
20040510 094725 127.0.0.1 SMTPD (015D00C2) EHLO ****.com 
20040510 094725 127.0.0.1 SMTPD (015D00C2) MAIL FROM:<0050156167@terrapinnmail.terrapinn.com> 
20040510 094725 127.0.0.1 SMTPD (015D00C2) RCPT TO:<89849886@****.com> 
20040510 094725 127.0.0.1 SMTPD (015D00C2) ERR ****.com invalid user <89849886@****.com 
20040510 094725 127.0.0.1 SMTPD (015F00C2) connect 220.***.***.*** port 45318 
20040510 094725 127.0.0.1 SMTPD (015F00C2) EHLO ****.com 
20040510 094725 127.0.0.1 SMTPD (015F00C2) MAIL FROM:<peter@taiwanslot.com.tw> 
20040510 094725 127.0.0.1 SMTPD (015F00C2) RCPT TO:<editor@****.com> 
20040510 094729 127.0.0.1 SMTPD (015F00C2) d:\IMail\spool\Ddf2d015f00c29151.SMD 0 
20040510 094729 127.0.0.1 SMTPD (015F00C2) performing antispam checks 
20040510 094729 127.0.0.1 SMTPD (015F00C2) <****.com> BLACKLIST: connecting to service (spamhaus:*:sbl.spamhaus.org) 
20040510 094734 127.0.0.1 SMTPD (016200C2) connect 220.***.***.*** port 45321 
20040510 094734 127.0.0.1 SMTPD (016200C2) EHLO ****.com 
20040510 094734 127.0.0.1 SMTPD (016200C2) MAIL FROM:<help@winzip.com> 
20040510 094734 127.0.0.1 SMTPD (016200C2) RCPT TO:<01052@****.com> 
20040510 094734 127.0.0.1 SMTPD (016200C2) ERR ****.com invalid user <01052@****.com 
20040510 094743 127.0.0.1 SMTPD (016700C2) connect 220.***.***.*** port 45325 
20040510 094743 127.0.0.1 SMTPD (016700C2) EHLO ****.com 
 
220.****是我现在的IP，61.**是我服务器的IP ***.com是我的域名 
 
 
我想，贴出这么多应该可以证明了是我的局域里的机器在发病毒邮件了吧。至于我不知道是哪部机器，，那是因为、、、我不可能只设定我一部机可以发E-mail而别的机不可以发吧(虽然我做得到，但做不得)

badwrs2000 发表于 2004-5-13 22:46:02

Re:[求助]怎么查出局域几哪部机在发病毒邮件？

那你的问题应该不是 “而刚好这个IP是我自己的局域的IP” 
 
提问请描述清楚！谢谢合作！

badwrs2000 发表于 2004-5-13 22:48:34

Re:[求助]怎么查出局域几哪部机在发病毒邮件？

你可以在 220.**** 上查看TCP连接情况吗？ 
 
或者你可以在局域网里sniffer啊～

页: [1]

邮件服务器-邮件系统-邮件技术论坛(BBS)'s Archiver