邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: MD连接后门 [打印本页]

作者: yon 时间: 2011-1-15 02:31
标题: MD连接后门
我今天也专门查看了下，MD始终在连接216.163.188.45 这个IP的80端口.  不知道这个服务器具体做什么的. 我搜索了下，有个国外这样的内容. 难道这个IP是邮件病毒保护服务器？

http://www.websense.com/support/article/t-kbarticle/How-to-Enable-Zero-Hour-Virus-Protection-Using-a-Proxy
      How to Enable Zero-Hour Virus Protection Using a Proxy          Products:       SurfControl Email Filter
         Versions:       6.0
                                                      Problem Description                                  Zero-Hour Virus Protection requires a connection to the internet. If you require Zero-Hour Virus Protection to access the internet via a proxy server, execute the batch file that's included in the zip file in the pane to the right according to the directions below.

Note: You must execute the batch file on all SEF configuration database instances.

The batch file can also be used with the Early Availability (EA) version of SurfControl E-mail Filter 6.0 to change the Zero-Hour server address to point to the GA server address: Resolver%d.scontrol.ctmail.com

The batch file can be also used to point to one of these static server names or IP addresses to connect to the Zero-Hour servers:

Server Name	Server IP Address
Resolver1.scontrol.ctmail.com	65.74.168.210
Resolver2.scontrol.ctmail.com	216.163.188.45
Resolver3.scontrol.ctmail.com	213.52.240.240
Resolver4.scontrol.ctmail.com	216.163.188.43
Resolver5.scontrol.ctmail.com	216.163.188.49

Notes:

·
These IP addresses may change.

·
If you have installed the final (GA) version of SurfControl E-mail Filter 6.0, the ServerAddress field value does not need to be changed.


                                                         Resolution                                  1.
Download the .zip file located in the pane to the right.

2.
Extract the batch file (ZeroHourProxy.bat) in the Surfcontrol E-mail Filter directory. By default, this directory is located at C:\Program Files\SurfControl E-mail Filter.

3.
Edit the batch file and modify the field values within the Zero Hour Server & Proxy details section.  These details include:

a.
Set ServerAddress to Resolver^%%d.scontrol.ctmail.com (default).

Note: To enter the % character you must enter ^%%
This is required for EA customers and for customers who want to point to a static server.

b.
Set ProxyAccess to 1 to use a proxy server or 0 to not use a proxy server and change only the Zero Hour server address.

c.
Set ProxyServer to the name or IP address of the proxy server.

d.
Set ProxyPort to the HTTP port number of the proxy server.

e.
Set ProxyAuth to the authentication method for the proxy server – NoAuth, Basic, NTLM, and so on.

f.
Set ProxyUser to the user name for the proxy server.

g.
Set ProxyPassword to the password for the proxy server.

h.
Set ProxyDomain to the domain name for the proxy server.

4.
At a command prompt, execute the batch file using the following command:

ZeroHourProxy.bat [SQL SERVER] [SEF CONFIG DATABASE] [SQL USER] [SQL PASSWORD]


Where:

[SQL SERVER] is the instance name or IP address of the SQL Server.

[SEF CONFIG DATABASE] is the name of the SEF Configuration database name. This is typically named 'STEMConfig'.

[SQL USER] is the user name of the SQL account.
For NT authentication, leave this field blank.

[SQL PASSWORD] is the password of the SQL account.
For NT authentication, leave this field blank.

         Example:

ZeroHourProxy.bat MySQLServer/SQLExpress STEMConfig [SQL password]

5.
Restart the rules service on all instances of E-mail Filter that share the database.

作者: wxhsh 时间: 2011-1-17 09:13
这是ＳＰ插件中的ＯＰ（爆发防护）验证地址，前一阵ＯＰ失效也是因为此地址发生故障导致的（可能和ＧＦＷ有关）。是正常应用，不是后门。

作者: yon 时间: 2011-1-29 02:06
看以前帖子有讨论过这个，但是没见讨论出结果，我自己又搜索了下，所以问问确认下.

MD很久没出新版本了，也不知道他们还干不了？

作者: Kyan 时间: 2011-1-30 21:41
标题: Re: MD連接後門
IP=216.163.188.45

NetRange: 216.163.176.0 - 216.163.191.255
CIDR:          216.163.176.0/20
http://www.commtouch.com/

OrgName:    Commtouch Inc.
OrgId:          COMMTO
Address:       292 Gibraltar dr.
Address:       Suite 107
City:             Sunnyvale
StateProv:    CA
PostalCode: 94089
Country:       US

是一個經過驗證的信息安全，網絡安全和反病毒技術的保安公司和服務供應商。

[ 本帖最后由 Kyan 于 2011-1-30 21:44 编辑 ]

作者: m3325599 时间: 2014-2-6 12:13
多谢提醒！{:soso_e104:}

作者: Kyan 时间: 2014-2-6 13:15

yon 发表于 2011-1-29 02:06
看以前帖子有讨论过这个，但是没见讨论出结果，我自己又搜索了下，所以问问确认下.

MD很久没出新版本了， ...

不懂英文的 yon 少唬弄人。無聊！{:soso_e154:}

作者: xiaofeng8j 时间: 2014-3-6 00:26
好贴就是好贴

作者: 山坛兄弟 时间: 2014-4-7 09:43
呵呵,在线验证类型

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.cn/)