W dniu 31.08.2009 05:32, Hajid pisze:
My domain panentour.com
* From: * Vidyadhar [mailto:vidyadha...@gmail.com]
*Sent:* Monday, August 31, 2009 10:23 AM
*To:* qmailtoaster-list@qmailtoaster.com
*Subject:* Re: [qmailtoaster] qmail machine being spammer help...
What is your domain name?
Sent on my BlackBerry® from Vodafone Essar
* From *: "Hajid"
*Date*: Mon, 31 Aug 2009 08:37:45 +0700
*To*: <qmailtoaster-list@qmailtoaster.com>
*Subject*: [qmailtoaster] qmail machine being spammer help...
Hi all, please help me with this spam. My qmail machine being spammer.
MESSAGE NUMBER 144860
--------------
Received: (qmail 26019 invoked by uid 30); 26 Aug 2009 21:18:10 -0000
To: undisclosed-recipients: ;
Subject: Employment Opportunity .
MIME-Version: 1.0
Date: Thu, 27 Aug 2009 04:18:10 +0700
From: "Jiangsu Chemical Co. Ltd" <jiangsuchemicals1...@yahoo.co.uk>
Reply-To: dr.jim...@yahoo.co.uk <mailto:dr.jim...@yahoo.co.uk>
Message-ID: <4858311e857373283a28c403d3b24...@localhost>
X-Sender: jiangsuchemicals1...@yahoo.co.uk
<mailto:jiangsuchemicals1...@yahoo.co.uk>
User-Agent: RoundCube Webmail/0.2
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"
26379 ? S 0:00 qmail-remote mysmtpmail.com
jiangsuchemicals1...@yahoo.co.uk
<mailto:jiangsuchemicals1...@yahoo.co.uk> philomenag...@mysmt
26380 ? S 0:00 qmail-remote mysmtpmail.com
jiangsuchemicals1...@yahoo.co.uk
<mailto:jiangsuchemicals1...@yahoo.co.uk> philomenaginocchio@
26383 ? S 0:00 qmail-remote dotstandards.com
jiangsuchemicals1...@yahoo.co.uk
<mailto:jiangsuchemicals1...@yahoo.co.uk> philomenaginocchi
26384 ? S 0:00 qmail-remote dotstandards.com
jiangsuchemicals1...@yahoo.co.uk
<mailto:jiangsuchemicals1...@yahoo.co.uk> philomenagi...@do
Remove RoundCube, use squirrelmail. Check your http log, you probably
find successful attack on RC (POST method).
For example:
"POST /roundcube/bin/html2text.php HTTP/1.0"
and check http error.log, if you find something like "saved" your server
is hacked. :(
Check do you have /etc/ssh2 or strange directory in /tmp.
Tripwire could help you but IMHO it's too late.
--
Pozdrawiam / Regards,
Aleksander Podsiad?y
mail: a...@westside.kielce.pl
jid: a...@jabber.westside.kielce.pl
ICQ: 201121279
gg: 9150578
