Rafael Andrade wrote:
[r...@net metalservice.ind.br]# qmailctl queue | wc -l
86325 :(
[r...@net metalservice.ind.br]# qmailctl queue | head -n 50
messages in queue: 40591
messages in queue but not yet preprocessed: 15
22 Jun 2010 15:46:19 GMT #2467164 1456 <anonym...@metalservice.ind.br>
remote mat...@mikrus.com.br
22 Jun 2010 15:09:18 GMT #3087267 1459 <anonym...@metalservice.ind.br>
remote robertajard...@yahoo.com.br
22 Jun 2010 15:37:38 GMT #2461644 1463 <anonym...@metalservice.ind.br>
remote mate...@cetesbnet.sp.gov.br
22 Jun 2010 15:45:28 GMT #2447016 1457 <anonym...@metalservice.ind.br>
remote mati...@joinet.com.br
22 Jun 2010 15:49:08 GMT #3069258 1461 <anonym...@metalservice.ind.br>
remote mattaro...@psibo.unibo.it
22 Jun 2010 15:38:28 GMT #2462288 2835 <#...@[]>
remote postmas...@net
22 Jun 2010 15:44:16 GMT #2465807 1455 <anonym...@metalservice.ind.br>
remote mati...@is-koeln.de
22 Jun 2010 15:28:35 GMT #2455112 1451 <anonym...@metalservice.ind.br>
remote rodolfo...@uol.com.br
22 Jun 2010 15:46:45 GMT #2467555 1454 <anonym...@metalservice.ind.br>
remote matildene...@msn.com
22 Jun 2010 15:02:44 GMT #3069603 1454 <anonym...@metalservice.ind.br>
remote roberto.come...@bol.com.br
22 Jun 2010 15:42:13 GMT #2464565 1460 <anonym...@metalservice.ind.br>
remote matoso.sona...@gmail.com
22 Jun 2010 15:34:11 GMT #2443198 2872 <#...@[]>
remote postmas...@net
22 Jun 2010 15:50:15 GMT #2470591 1459 <anonym...@metalservice.ind.br>
remote mat...@sum.desktop.com.br
22 Jun 2010 15:53:22 GMT #2450535 1465 <anonym...@metalservice.ind.br>
local metalservice.ind.br-audito...@metalservice.ind.br
remote matilhaproduc...@terra.com.br
22 Jun 2010 15:56:32 GMT #2506264 1452 <anonym...@metalservice.ind.br>
local metalservice.ind.br-audito...@metalservice.ind.br
remote matr...@uol.com.br
22 Jun 2010 15:53:25 GMT #2448971 1457 <anonym...@metalservice.ind.br>
local metalservice.ind.br-audito...@metalservice.ind.br
remote matle...@terra.com.br
22 Jun 2010 15:43:26 GMT #2465278 1458 <anonym...@metalservice.ind.br>
remote mat...@infraero.gov.br
22 Jun 2010 15:38:51 GMT #2462702 1459 <anonym...@metalservice.ind.br>
remote mat...@dequi.eel.usp.br
As i can delete all msgs to anonym...@metalservice.ind.br using
qmail-remove ( syntax ? )
Thanks so much again
I think that
# qmHandle -tf "anonym...@metalservice.ind.br"
will clean them out. I think you should do
# qmailctl stop
first, then start qmail back up when qmHandle completes.
Then you need to find out which account is being used to authenticate.
# qmlog -nl -g anonym...@metalservice smtp \
> | grep "CHKUSER accepted sender" | head -n10
This will show you the first 10 occurrences of messages that were
submitted with that user id. You should see something like:
06-07 02:58:23 CHKUSER accepted sender: from
<anonym...@metalservice.ind.br:??...@???????:> ...
The ??...@??????? part is the account name that was used to
authenticate. Change that password, and you should no longer get more
spam messages from this spammer.
Then re-do the qmHandle command again to clean out any messages that
came in since the first time you ran it.
I'm presuming here that you have only one account/pw that's been
compromised. You might want to do something like
# qmlog -nl -g anonym...@metalservice smtp \
> | grep "CHKUSER accepted sender" | grep -v "??...@???????"
That will spit out any other account names that might have been used. If
there was only one compromised account, this command will return nothing.
--
-Eric 'shubes'
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com
For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
