spool 文件夹问题

ineedrmb · 发表于 2010-3-29 11:11:37

说了和木马无关了，你这种情况只可能是被盗用作转发了，通过日志查询器找到那个帐号就行了。

badboylife · 发表于 2010-3-29 17:46:57

原帖由 ineedrmb 于 2010-3-29 11:11 发表
说了和木马无关了，你这种情况只可能是被盗用作转发了，通过日志查询器找到那个帐号就行了。

斑竹，日志查询器是在哪里？8.22有吗？从来没用过

tdk · 发表于 2010-3-29 21:03:07

http://www.abuse.net/relay.html
先去这里测试一下有没有被匿名中继的可能

badboylife · 发表于 2010-3-30 09:37:36

谢谢斑竹 tdk ，去了你给的网页，测试没有被匿名中继

lgj858 · 发表于 2010-3-30 14:14:23

日志的筛选分析工具本身就自带的
到开始菜单里面去找

badboylife · 发表于 2010-3-30 16:43:41

呵呵，找到筛选分析工具了，用imai好多年，还是第一次用

挺好使的
谢谢斑竹

tdk · 发表于 2010-3-30 20:41:19

用了筛选工具，有结果了吗

badboylife · 发表于 2010-4-7 12:26:42

筛选日志，不太看得懂，斑竹帮分析分析我贴上来
Analyze V1.0

Log Start 04/06 00:02:00 - Log End 04/06 23:59:00
Logs Analyzed:
D:\IMail\spool\sys0406.txt
-------------------------------------------------------------------------------
SMTPD Connections
Occurrences Connecting IP
-------------------------------------------------------------------------------
Total - 1384

1,067 我的ip
10 timed
6 190.131.27.85
4 90.194.207.217
3 12.130.137.125
2 75.223.8.15
2 80.188.115.92
.......
-------------------------------------------------------------------------------
SMTPD Errors
Occurrences Error
-------------------------------------------------------------------------------
Total - 3

1 Invalid User IP = 118.168.141.12
1 Invalid User IP = 118.168.142.81
1 Invalid User IP = 114.45.1.39
-------------------------------------------------------------------------------
SMTP Local Deliveries
Occurrences Recipient
-------------------------------------------------------------------------------
Total - 145

61 我的用户1
47 我的用户2
37 我的用户3
-------------------------------------------------------------------------------
SMTP Senders (Remote Deliveries)
Occurrences Sender
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
SMTP Senders (Local Deliveries)
Occurrences Sender
-------------------------------------------------------------------------------

Total - 145

3 anamaria_jodieyt@emr.net
3 malisaelisaqk@alfa.com
3 florrie_juli_je@ge-smart.com
3 backjj@latimes.com
3 eldora_rubi_sp@wwdb.org
3 e.darnellji@gbusiness.com
3 c_tracy_ww@ryeco.com
3 roadbedem@wixgame.com
3 temilia_it@carrier.utc.com
3 trompe3y@sofitel.com
3 v.sherriepb@wmle.com
3 bjacqualine_bm@ep.com
3 boughtmd@yourdictionary.com
3 vickey_olimpia_dv@novellus.com
3 t_indiraga@jencoprod.com
3 distinguishkj@maylane.com
3 biniv5@911tabs.com
3 n_brandoneg@jmfarms.com
3 mlidiajo@aebi.com
3 angeleleonorch@avaya.com
3 kamilahmuoi_xd@accused.com
3 nakiafletabg@litai.com
3 mdiamondjv@dyckes.com
3 cleotildelouiexj@ksb.com
3 t_marhta_ce@toto.net
3 extracellulareg@vignette.com
3 carolynn.svetlanaok@naturalimpulse.com
3 alease.cheryllls@telenor.com
2 我的用户1
2 我的用户2
1 uxaee8450@sky.com
1 ogysew2559@hinet.net
1 ozeymumiy3839@otenet.gr
..........
-------------------------------------------------------------------------------
SMTP Remote Delivieries
Occurrences Recipient
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
SMTP Deliveries to host
Occurrences Host
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
SMTP Errors
Occurrences Error
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
SMTP Mx Failures
Occurrences IP
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web Logins
Occurrences User
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web Files
Occurrences File
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web HEAD Requests
Occurrences IP
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web Hits
Occurrences IP
------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web Errors
Occurrences IP
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Pop Logon
Occurrences User
-------------------------------------------------------------------------------
Total - 67

59 我的用户3
4 我的用户2
4 我的用户1
-------------------------------------------------------------------------------
IMAP Login
Occurrences User
------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
IMAP Errors
Occurrences User
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
POP Errors
Occurrences User
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Unknown Log Lines
Occurrences Message
-------------------------------------------------------------------------------
Total - 110

72 ***************************************************
36 Listen Thread Exiting - ***************************
2 Protocol Handler Invalid State 1
-------------------------------------------------------------------------------
Domain Senders - Remote Delivery
Size Occurrences Domain
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Remote Delivery - Senders
Size Occurrences Sender
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Remote Recipients by Domain
Size Occurrences Domain
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Local Recipients by Sender Domain
Size Occurrences Domain
-------------------------------------------------------------------------------

27,341 3 我的域名
20,329 2 doruk.net.tr
19,166 2 telecomitalia.it
18,516 3 maylane.com
18,441 2 rima-tde.net
18,345 3 wixgame.com
18,327 3 latimes.com
18,294 3 yourdictionary.com
18,189 3 sofitel.com
18,176 2 saudi.net.sa
18,138 3 vignette.com
18,051 3 911tabs.com
15,281 2 sky.com
14,514 2 alicedsl.de
14,204 1 info.snapfish.com
10,843 1 verizon.net
10,802 1 fpt.vn
10,735 1 veloxzone.com.br
10,179 1 ono.com
10,135 1 virtua.com.br
10,056 1 gaoland.net
10,049 1 com.pl
10,032 1 hinet.net
9,876 1 brasiltelecom.net.br
9,813 1 ukrtel.net
9,740 1 danisnet.md
9,738 1 btopenworld.com
..........
-------------------------------------------------------------------------------
Local Deliveries by Sender
Size Occurrences Sender
-------------------------------------------------------------------------------

18,516 3 distinguishkj@maylane.com
18,345 3 roadbedem@wixgame.com
18,329 2 我的用户1
18,327 3 backjj@latimes.com
18,294 3 boughtmd@yourdictionary.com
18,189 3 trompe3y@sofitel.com
18,138 3 extracellulareg@vignette.com
18,051 3 biniv5@911tabs.com
14,204 1 snapfish@info.snapfish.com
10,843 1 asevaa5093@verizon.net
10,802 1 oqania7573@fpt.vn
10,735 1 fodyd6823@veloxzone.com.br
10,457 1 ulylyewemu6133@doruk.net.tr
10,179 1 egosoisu9505@ono.com
10,135 1 wenobeje2853@virtua.com.br
10,056 1 xusihejyx4285@gaoland.net
................
-------------------------------------------------------------------------------
Local Recipients

Size Occurrences User
-------------------------------------------------------------------------------

236,319 47 我的用户1
205,628 61 我的用户2
153,391 37 我的用户3
-------------------------------------------------------------------------------
Local Recipent Domains
Size Occurrences Domain
-------------------------------------------------------------------------------
595,338 145 我的域名

ineedrmb · 发表于 2010-4-9 16:54:25

从你的日志分析结果里看，并没有明显的被利用的情况。

badboylife · 发表于 2010-4-12 10:01:57

SMTP Senders (Local Deliveries) 是什么意思，这里大部分都是别人的邮箱地址，怎么就成了sender了？

		自动登录	找回密码
密码			会员注册

[求助] spool 文件夹问题

回复 16楼 badboylife 的帖子