邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: [求助]怎么查出局域几哪部机在发病毒邮件？ [打印本页]

作者: cove 时间: 2004-5-12 10:17
标题: [求助]怎么查出局域几哪部机在发病毒邮件？
也许不该在这里提问的^_^ 
 
从Imail的记录文件里可以查出一个IP在发病毒邮件，而刚好这个IP是我自己的局域的IP。现在的问题是怎么查出是哪部机在发病毒邮件？用什么软件？

作者: cloudx 时间: 2004-5-12 11:04
标题: Re:[求助]怎么查出局域几哪部机在发病毒邮件？
你怎么查到的？把你的日志文件帖出来看看？

作者: badwrs2000 时间: 2004-5-12 16:19
标题: Re:[求助]怎么查出局域几哪部机在发病毒邮件？
你都知道是自己的局域的IP，还不知道是哪部机器？？

作者: cove 时间: 2004-5-12 18:04
标题: Re:[求助]怎么查出局域几哪部机在发病毒邮件？
20040510 060508 127.0.0.1 SMTPD (0027012C) [127.0.0.1] MAIL FROM:<webmaster@****.com> 
20040510 060508 127.0.0.1 SMTPD (0027012C) [127.0.0.1] RCPT TO:<huili5198@sina.com> 
20040510 060508 127.0.0.1 SMTPD (0027012C) [127.0.0.1] d:\IMail\spool\Dab140027012c8553.SMD 1285 
20040510 060508 127.0.0.1 SMTPD (0027012C) performing antispam checks 
20040510 060942 127.0.0.1 SMTPD (0028012C) [61.***.***.***] connect 61.157.139.230 port 37015 
20040510 060942 127.0.0.1 SMTPD (0028012C) [61.157.139.230] EHLO ****.com 
20040510 060942 127.0.0.1 SMTPD (0028012C) [61.157.139.230] MAIL FROM:<game@****.com> 
20040510 060942 127.0.0.1 SMTPD (0028012C) [61.157.139.230] RCPT TO:<webmaster@****.com> 
20040510 060942 127.0.0.1 SMTPD (0028012C) [61.157.139.230] ERR ****.com invalid user <webmaster@****.com 
20040510 063233 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 87 
20040510 064816 127.0.0.1 SMTPD (0029012C) [61.***.***.***] connect 61.129.59.47 port 17129 
20040510 064816 127.0.0.1 SMTPD (0029012C) [61.129.59.47] HELO mx47.eachnet.com 
20040510 064816 127.0.0.1 SMTPD (0029012C) [61.129.59.47] MAIL FROM:<eoi@eachnet.com> 
20040510 064816 127.0.0.1 SMTPD (0029012C) [61.129.59.47] RCPT TO:<tenten@****.net> 
20040510 064816 127.0.0.1 SMTPD (0029012C) [61.129.59.47] d:\IMail\spool\Db5300029012c0553.SMD 14962 
20040510 064816 127.0.0.1 SMTPD (0029012C) performing antispam checks 
20040510 064849 127.0.0.1 SMTP (0368002B) processing d:\IMail\spool\Qb5300029012c0553.SMD 
20040510 064849 127.0.0.1 SMTP (0368002B) Got White List and Content Filter for ****.com 
20040510 064849 127.0.0.1 SMTP (0368002B) [eachnet.com] in white list 
20040510 064849 127.0.0.1 SMTP (0368002B) ldeliver chencheng.net tenten-main (1) eoi@eachnet.com 14962 
20040510 064849 127.0.0.1 SMTP (0368002B) ldeliver ****.com all-main (1) eoi@eachnet.com 14962 
20040510 064849 127.0.0.1 SMTP (0368002B) finished d:\IMail\spool\Qb5300029012c0553.SMD status=1 
20040510 070234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 88 
20040510 073234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 89 
20040510 080234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 90 
20040510 083234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 91 
20040510 085531 127.0.0.1 SMTPD (002A012C) [61.***.***.***] connect 61.157.139.230 port 37725 
20040510 085531 127.0.0.1 SMTPD (002A012C) [61.157.139.230] EHLO ****.com 
20040510 085531 127.0.0.1 SMTPD (002A012C) [61.157.139.230] MAIL FROM:<zhang98722@6.com.cn> 
20040510 085531 127.0.0.1 SMTPD (002A012C) [61.157.139.230] RCPT TO:<webmaster@****.com> 
20040510 085531 127.0.0.1 SMTPD (002A012C) [61.157.139.230] ERR ****.com invalid user <webmaster@****.com 
20040510 090234 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 92 
SYSLOGD 8.01, Copyright ? 1994-2001, Ipswitch, Inc. 
20040510 091459 0.0.0.0:514 Server ready for action 
20040510 092915 127.0.0.1 POP3D (00000198) logon success for cove ****.com from 220.***.***.*** 
20040510 092916 127.0.0.1 POP3D (00000198) logoff for cove R:1, D:0, P:0 
20040510 092920 127.0.0.1 POP3D (00000198) logon success for cove ****.com from 220.***.***.*** 
20040510 092921 127.0.0.1 POP3D (00000198) logoff for cove R:1, D:1, P:0 
20040510 094458 127.0.0.1 SMTP (00000000) Info - Queue manager starting Queue run 1 
20040510 094712 127.0.0.1 SMTPD (01FF0082) [61.***.***.***] connect 220.***.***.*** port 45306 
20040510 094712 127.0.0.1 SMTPD (015C00C2) [61.***.***.***] connect 220.***.***.*** port 45307 
20040510 094712 127.0.0.1 SMTPD (01FF0082) [220.***.***.***] EHLO ****.com 
20040510 094712 127.0.0.1 SMTPD (015C00C2) [220.***.***.***] EHLO ****.com 
20040510 094712 127.0.0.1 SMTPD (01FF0082) [220.***.***.***] MAIL FROM:<angie@taiwanslot.com.tw> 
20040510 094712 127.0.0.1 SMTPD (015C00C2) [220.***.***.***] MAIL FROM:<sm01084@****.com> 
20040510 094712 127.0.0.1 SMTPD (01FF0082) [220.***.***.***] RCPT TO:<01020@****.com> 
20040510 094712 127.0.0.1 SMTPD (01FF0082) [220.***.***.***] ERR ****.com invalid user <01020@****.com 
20040510 094712 127.0.0.1 SMTPD (015C00C2) [220.***.***.***] RCPT TO:<chinagame@****.com> 
20040510 094717 127.0.0.1 SMTPD (02030082) [61.***.***.***] connect 220.***.***.*** port 45310 
20040510 094717 127.0.0.1 SMTPD (02030082) [220.***.***.***] EHLO ****.com 
20040510 094717 127.0.0.1 SMTPD (02030082) [220.***.***.***] MAIL FROM:<20040504101100.sm01060@****.com> 
20040510 094717 127.0.0.1 SMTPD (02030082) [220.***.***.***] RCPT TO:<01020@****.com> 
20040510 094717 127.0.0.1 SMTPD (02030082) [220.***.***.***] ERR ****.com invalid user <01020@****.com 
20040510 094717 127.0.0.1 SMTPD (02040082) [61.***.***.***] connect 220.***.***.*** port 45311 
20040510 094717 127.0.0.1 SMTPD (02040082) [220.***.***.***] EHLO ****.com 
20040510 094718 127.0.0.1 SMTPD (02040082) [220.***.***.***] MAIL FROM:<56098832@****.com> 
20040510 094718 127.0.0.1 SMTPD (02040082) [220.***.***.***] RCPT TO:<chinagame@****.com> 
20040510 094722 127.0.0.1 SMTPD (02040082) [220.***.***.***] d:\IMail\spool\Ddf26020400827434.SMD 0 
20040510 094722 127.0.0.1 SMTPD (02040082) performing antispam checks 
20040510 094722 127.0.0.1 SMTPD (02040082) [00001812] <****.com> BLACKLIST: connecting to service (spamhaus:*:sbl.spamhaus.org) 
20040510 094723 127.0.0.1 SMTPD (015C00C2) [220.***.***.***] d:\IMail\spool\Ddf20015c00c25e2b.SMD 0 
20040510 094723 127.0.0.1 SMTPD (015C00C2) performing antispam checks 
20040510 094723 127.0.0.1 SMTPD (015C00C2) [00001488] <****.com> BLACKLIST: connecting to service (spamhaus:*:sbl.spamhaus.org) 
20040510 094725 127.0.0.1 SMTPD (015D00C2) [61.***.***.***] connect 220.***.***.*** port 45317 
20040510 094725 127.0.0.1 SMTPD (015D00C2) [220.***.***.***] EHLO ****.com 
20040510 094725 127.0.0.1 SMTPD (015D00C2) [220.***.***.***] MAIL FROM:<0050156167@terrapinnmail.terrapinn.com> 
20040510 094725 127.0.0.1 SMTPD (015D00C2) [220.***.***.***] RCPT TO:<89849886@****.com> 
20040510 094725 127.0.0.1 SMTPD (015D00C2) [220.***.***.***] ERR ****.com invalid user <89849886@****.com 
20040510 094725 127.0.0.1 SMTPD (015F00C2) [61.***.***.***] connect 220.***.***.*** port 45318 
20040510 094725 127.0.0.1 SMTPD (015F00C2) [220.***.***.***] EHLO ****.com 
20040510 094725 127.0.0.1 SMTPD (015F00C2) [220.***.***.***] MAIL FROM:<peter@taiwanslot.com.tw> 
20040510 094725 127.0.0.1 SMTPD (015F00C2) [220.***.***.***] RCPT TO:<editor@****.com> 
20040510 094729 127.0.0.1 SMTPD (015F00C2) [220.***.***.***] d:\IMail\spool\Ddf2d015f00c29151.SMD 0 
20040510 094729 127.0.0.1 SMTPD (015F00C2) performing antispam checks 
20040510 094729 127.0.0.1 SMTPD (015F00C2) [00001448] <****.com> BLACKLIST: connecting to service (spamhaus:*:sbl.spamhaus.org) 
20040510 094734 127.0.0.1 SMTPD (016200C2) [61.***.***.***] connect 220.***.***.*** port 45321 
20040510 094734 127.0.0.1 SMTPD (016200C2) [220.***.***.***] EHLO ****.com 
20040510 094734 127.0.0.1 SMTPD (016200C2) [220.***.***.***] MAIL FROM:<help@winzip.com> 
20040510 094734 127.0.0.1 SMTPD (016200C2) [220.***.***.***] RCPT TO:<01052@****.com> 
20040510 094734 127.0.0.1 SMTPD (016200C2) [220.***.***.***] ERR ****.com invalid user <01052@****.com 
20040510 094743 127.0.0.1 SMTPD (016700C2) [61.***.***.***] connect 220.***.***.*** port 45325 
20040510 094743 127.0.0.1 SMTPD (016700C2) [220.***.***.***] EHLO ****.com 
 
220.****是我现在的IP，61.**是我服务器的IP ***.com是我的域名 
 
 
我想，贴出这么多应该可以证明了是我的局域里的机器在发病毒邮件了吧。至于我不知道是哪部机器，，那是因为、、、我不可能只设定我一部机可以发E-mail而别的机不可以发吧(虽然我做得到，但做不得)

作者: badwrs2000 时间: 2004-5-13 22:46
标题: Re:[求助]怎么查出局域几哪部机在发病毒邮件？
那你的问题应该不是 “而刚好这个IP是我自己的局域的IP” 
 
提问请描述清楚！谢谢合作！

作者: badwrs2000 时间: 2004-5-13 22:48
标题: Re:[求助]怎么查出局域几哪部机在发病毒邮件？
你可以在 220.**** 上查看TCP连接情况吗？ 
 
或者你可以在局域网里sniffer啊～

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.cn/)