MDaemon利用测试帐号不停的在对外发送垃圾邮件

ravenlm

各位,今天上午发现,MDaemon原来的一个测试帐号test@company.com 一直在对外发送垃圾邮件,造成正常邮件都无法发送.
我已删除了test帐号,并且将设置改为SMTP需要验证,但是现在MDaemon还是在不停的对外发送邮件,不知道是不是系统中毒,还是MDaemon中毒,或者遭到外部攻击.

请问有什么办法可以检测一下么.

ravenlm

部分router日志
Wed 2010-08-18 00:00:42: ----------
Wed 2010-08-18 00:00:43: Routing message (inbound queue): d:\mdaemon\queues\inbound\md50000007256.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: annikano@algonet.se; Size: 5441; Message: d:\mdaemon\queues\remote\md35000039960.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: anniez18@aol.com; Size: 5435; Message: d:\mdaemon\queues\remote\md35000039961.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: annievbenjamin@bellsouth.net; Size: 5459; Message: d:\mdaemon\queues\remote\md35000039962.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: annieup@go.com; Size: 4772; Message: d:\mdaemon\queues\remote\md35000039963.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: annieyf@go.com; Size: 4772; Message: d:\mdaemon\queues\remote\md35000039963.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: anniia@go.com; Size: 4772; Message: d:\mdaemon\queues\remote\md35000039963.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: annietom@go.com; Size: 5372; Message: d:\mdaemon\queues\remote\md35000039963.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: annietran79@hotmail.com; Size: 5449; Message: d:\mdaemon\queues\remote\md35000039964.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: annikah@imagicraft.com; Size: 5447; Message: d:\mdaemon\queues\remote\md35000039965.msg
Wed 2010-08-18 00:00:43: *  From: test@company.com; Recipient: annieward18@yahoo.com; Size: 5445; Message: d:\mdaemon\queues\remote\md35000039966.msg
Wed 2010-08-18 00:00:43: *  Subject: Contact Person: Mr. Frank Williams,
Wed 2010-08-18 00:00:43: *  Message-ID:
Wed 2010-08-18 00:00:43: ----------
Wed 2010-08-18 00:00:45: Routing message (local queue): d:\mdaemon\queues\local\pd75000009522.msg
Wed 2010-08-18 00:00:45: *  From: MDaemon@company.com; Recipient: test@company.com
Wed 2010-08-18 00:00:45: *  Subject: Transient Delivery Failure
Wed 2010-08-18 00:00:45: *  Message-ID: <MDAEMON7876201008172303.AA0331667@company.com>
Wed 2010-08-18 00:00:45: *  Size: 14606; Message: d:\mdaemon\users\company.com\test\md50000008875.msg
Wed 2010-08-18 00:00:45: ----------
Wed 2010-08-18 00:00:45: Routing message (local queue): d:\mdaemon\queues\local\pd75000009523.msg
Wed 2010-08-18 00:00:45: *  From: MDaemon@company.com; Recipient: test@company.com
Wed 2010-08-18 00:00:45: *  Subject: Transient Delivery Failure
Wed 2010-08-18 00:00:45: *  Message-ID: <MDAEMON7877201008172303.AA0331683@company.com>
Wed 2010-08-18 00:00:45: *  Size: 10349; Message: d:\mdaemon\users\company.com\test\md50000008876.msg
Wed 2010-08-18 00:00:45: ----------
Wed 2010-08-18 00:00:45: Routing message (local queue): d:\mdaemon\queues\local\pd75000017354.msg
Wed 2010-08-18 00:00:45: *  From: MDaemon@company.com; Recipient: liming@company.com
Wed 2010-08-18 00:00:45: *  Subject: Mail Statistics Summary - company.com - Tue, 17 Aug 2010
Wed 2010-08-18 00:00:45: *  Message-ID: <MDAEMON5176201008180000.AA0045073@company.com>
Wed 2010-08-18 00:00:45: *  Forwarded copy created; Recipient: ravenlm@Msn.com
Wed 2010-08-18 00:00:45: *  Size: 15798; Message: d:\mdaemon\users\company.com\liming\mail statistics summary - company.com.imap\md50000000103.msg
Wed 2010-08-18 00:00:45: ----------
Wed 2010-08-18 00:00:45: Routing message (inbound queue): d:\mdaemon\queues\inbound\md50000007257.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: anniqat@algonet.se; Size: 5439; Message: d:\mdaemon\queues\remote\md35000039967.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: annisce@bellsouth.net; Size: 5445; Message: d:\mdaemon\queues\remote\md35000039968.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: annisa5@comcast.net; Size: 5441; Message: d:\mdaemon\queues\remote\md35000039969.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: annimoon@gmail.com; Size: 5439; Message: d:\mdaemon\queues\remote\md35000039970.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: anniss@idir.net; Size: 5433; Message: d:\mdaemon\queues\remote\md35000039971.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: annis@quebectel.com; Size: 4772; Message: d:\mdaemon\queues\remote\md35000039972.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: annine@quebectel.com; Size: 5372; Message: d:\mdaemon\queues\remote\md35000039972.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: annikeholland@verizon.net; Size: 5453; Message: d:\mdaemon\queues\remote\md35000039973.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: annisanash@yahoo.com; Size: 4772; Message: d:\mdaemon\queues\remote\md35000039975.msg
Wed 2010-08-18 00:00:45: *  From: test@company.com; Recipient: annineg70@yahoo.com; Size: 5372; Message: d:\mdaemon\queues\remote\md35000039975.msg
Wed 2010-08-18 00:00:45: *  Subject: Contact Person: Mr. Frank Williams,
Wed 2010-08-18 00:00:45: *  Message-ID:
Wed 2010-08-18 00:00:45: ----------

ravenlm

部分系统日志:



Wed 2010-08-18 04:32:21: ----------
Wed 2010-08-18 04:32:21: Session 5609; child 14
Wed 2010-08-18 04:32:20: Parsing message <d:\mdaemon\queues\remote\pd35000052278.msg>
Wed 2010-08-18 04:32:20: *  From: test@company.com
Wed 2010-08-18 04:32:20: *  To: asia22@bellsouth.net
Wed 2010-08-18 04:32:20: *  Subject: Contact Person: Mr. Frank Williams,
Wed 2010-08-18 04:32:20: *  Message-ID:
Wed 2010-08-18 04:32:20: Attempting SMTP connection to [bellsouth.net]
Wed 2010-08-18 04:32:20: Resolving MX records for [bellsouth.net] (DNS Server: 210.22.70.3)...
Wed 2010-08-18 04:32:20: *  P=010 S=000 D=bellsouth.net TTL=(115) MX=[gateway-f2.isp.att.net] {207.115.11.16}
Wed 2010-08-18 04:32:20: *  P=010 S=001 D=bellsouth.net TTL=(115) MX=[gateway-f1.isp.att.net] {204.127.217.16}
Wed 2010-08-18 04:32:20: Attempting SMTP connection to [207.115.11.16:25]
Wed 2010-08-18 04:32:20: Waiting for socket connection...
Wed 2010-08-18 04:32:20: *  Connection established (192.168.5.10:4838 -> 207.115.11.16:25)
Wed 2010-08-18 04:32:20: Waiting for protocol to start...
Wed 2010-08-18 04:32:21: <-- 550-210.22.87.22 blocked by ldapu=rblmx,dc=att,dc=net
Wed 2010-08-18 04:32:21: <-- 550 Error - Blocked for abuse. See http://att.net/blocks
Wed 2010-08-18 04:32:21: --> QUIT
Wed 2010-08-18 04:32:21: Socket connection closed by the other side (how rude!)
Wed 2010-08-18 04:32:21: SMTP session terminated (Bytes in/out: 115/6)
Wed 2010-08-18 04:32:21: ----------
Wed 2010-08-18 04:32:21: Session 2899; child 10; thread 2572
Wed 2010-08-18 04:32:21: Accepting SMTP connection from [61.153.1.153:37099]
Wed 2010-08-18 04:32:21: Performing PTR lookup (153.1.153.61.IN-ADDR.ARPA)
Wed 2010-08-18 04:32:21: *  Error: *  Name server reports domain name unknown
Wed 2010-08-18 04:32:21: *  No PTR records found
Wed 2010-08-18 04:32:21: ---- End PTR results
Wed 2010-08-18 04:32:21: --> 220 company.com ESMTP MDaemon 9.6.5; Wed, 18 Aug 2010 04:32:21 +0800
Wed 2010-08-18 04:32:21: <-- HELO eyou.net
Wed 2010-08-18 04:32:21: Performing IP lookup (eyou.net)
Wed 2010-08-18 04:32:21: *  D=eyou.net TTL=(4) A=[219.143.47.98]
Wed 2010-08-18 04:32:21: ---- End IP lookup results
Wed 2010-08-18 04:32:21: --> 250 company.com Hello eyou.net (may be forged), pleased to meet you
Wed 2010-08-18 04:32:21: <-- MAIL FROM: <>
Wed 2010-08-18 04:32:21: Performing SPF lookup (eyou.net / 61.153.1.153)
Wed 2010-08-18 04:32:21: *  Result: none; no SPF record in DNS
Wed 2010-08-18 04:32:21: ---- End SPF results
Wed 2010-08-18 04:32:21: --> 250 <>, Sender ok
Wed 2010-08-18 04:32:21: <-- RCPT TO: <test@company.com>
Wed 2010-08-18 04:32:21: Performing DNS-BL lookup (61.153.1.153 - connecting IP)
Wed 2010-08-18 04:32:21: *  zen.spamhaus.org，spamhaus 列出的 $IP$，请参见http://www.spamhaus.org - passed
Wed 2010-08-18 04:32:21: ---- End DNS-BL results
Wed 2010-08-18 04:32:21: --> 250 <test@company.com>, Recipient ok
Wed 2010-08-18 04:32:21: <-- DATA
Wed 2010-08-18 04:32:21: Creating temp file (SMTP): d:\mdaemon\queues\temp\md50000091791.tmp
Wed 2010-08-18 04:32:21: --> 354 Enter mail, end with <CRLF>.<CRLF>
Wed 2010-08-18 04:32:21: Message size: 4255 bytes
Wed 2010-08-18 04:32:21: Performing DKIM lookup
Wed 2010-08-18 04:32:21: *  File: d:\mdaemon\queues\temp\md50000091791.tmp
Wed 2010-08-18 04:32:21: *  Message-ID: 482074235.00775@eyou.net
Wed 2010-08-18 04:32:21: *  Result: neutral
Wed 2010-08-18 04:32:21: ---- End DKIM results
Wed 2010-08-18 04:32:21: Performing DomainKeys lookup (Sender: MAILER-DAEMON@eyou.net)
Wed 2010-08-18 04:32:21: *  File: d:\mdaemon\queues\temp\md50000091791.tmp
Wed 2010-08-18 04:32:21: *  Message-ID: 482074235.00775@eyou.net
Wed 2010-08-18 04:32:21: *  Querying for policy: eyou.net
Wed 2010-08-18 04:32:21: *    Querying: _domainkey.eyou.net ...
Wed 2010-08-18 04:32:21: *    DNS: *  Name server reports domain name unknown
Wed 2010-08-18 04:32:21: *  Result: neutral
Wed 2010-08-18 04:32:21: ---- End DomainKeys results
Wed 2010-08-18 04:32:21: Message creation successful: d:\mdaemon\queues\inbound\md50000018569.msg
Wed 2010-08-18 04:32:21: --> 250 Ok, message saved <Message-ID: 482074235.00775@eyou.net>
Wed 2010-08-18 04:32:21: <-- QUIT