Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > ISPConfig 2 > General

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 1st December 2005, 12:51
rayit rayit is offline
Member
 
Join Date: Nov 2005
Posts: 93
Thanks: 0
Thanked 2 Times in 2 Posts
Default I am spammed by sober.U virus from my own account?

I am spammed by sober.U virus warnings and warings that messages can not be send to for example Office@cia.gov
They seem to be send from my own account web2_rmarx@ns1.rayit.com

What can I do about this?

How to stop that clamAV mails to the person who send teh virus?

DOes somebody has advise?
I checked all my pc's and there are no virus on them etc..

I added 3 parts of log file
many thanks

Raymond
RayIT

--------------------------------------------------------------------------
Dec 1 07:16:42 localhost postfix/qmgr[23657]: 2FAF0372851: from=<web2_rmarx@ns1.rayit.com>, size=999, nrcpt=1 (queue active)
Dec 1 07:16:42 localhost TrashScan[8676]: ************************************************** **********************
Dec 1 07:16:42 localhost TrashScan[8676]: Suspicious code in mail attachment detected !!!
Dec 1 07:16:42 localhost TrashScan[8676]: From: Post@fbi.gov
Dec 1 07:16:42 localhost TrashScan[8676]: To: mailingbox@rayit.com
Dec 1 07:16:42 localhost TrashScan[8676]: Subj: Your IP was logged
Dec 1 07:16:42 localhost TrashScan[8676]: Date: Thu, 01 Dec 2005 06:09:55 GMT
Dec 1 07:16:42 localhost TrashScan[8676]: Virus: Worm.Sober.U
Dec 1 07:16:42 localhost TrashScan[8676]: Alert: Not sent
Dec 1 07:16:42 localhost TrashScan[8676]: Notification: Messages sent to Post@fbi.gov and mailingbox@rayit.com
Dec 1 07:16:42 localhost TrashScan[8676]: Check mail.virus !!!
Dec 1 07:16:42 localhost TrashScan[8676]: ************************************************** **********************

-------------------------------------------------------------------------
MANY MESSAGES
from=<web2_rmarx@ns1.rayit.com>, size=1002, nrcpt=1 (queue active)
Dec 1 06:39:04 localhost postfix/qmgr[23657]: 8B09637293E: from=<web2_rmarx@ns1.rayit.com>, size=1002, nrcpt=1 (queue active)
Dec 1 06:39:04 localhost postfix/qmgr[23657]: 877EF372911: from=<web2_rmarx@ns1.rayit.com>, size=1002, nrcpt=1 (queue active)
-----------------------------------------------------------------------
MANY MESSAGES

Dec 1 06:40:35 localhost postfix/qmgr[23657]: 8741D37282A: to=<Office@cia.gov>, relay=none, delay=41828, status=deferred (delivery temporarily suspended: connect to relay7$
Dec 1 06:40:35 localhost postfix/qmgr[23657]: DDC1A372839: to=<Office@cia.gov>, relay=none, delay=41822, status=deferred (delivery temporarily suspended: connect to relay7$
Dec 1 06:40:35 localhost postfix/qmgr[23657]: DC7F5372924: to=<Office@cia.gov>, relay=none, delay=41750, status=deferred (delivery temporarily suspended: connect to relay7$
Dec 1 06:40:35 localhost postfix/qmgr[23657]: DFF2C37283F: to=<Office@cia.gov>, relay=none, delay=41757, status=deferred (delivery temporarily suspended: connect to relay7$
Dec 1 06:40:35 localhost postfix/qmgr[23657]: 05ECC372860:
Reply With Quote
Sponsored Links
  #2  
Old 1st December 2005, 12:55
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,460
Thanks: 813
Thanked 5,240 Times in 4,108 Posts
Default

http://www.howtoforge.com/forums/showthread.php?t=911

The virus must not be on one of your computers. the email viruses chose the sender adresses randomly from the addressbooks of the infected computer.
Reply With Quote
  #3  
Old 1st December 2005, 13:04
rayit rayit is offline
Member
 
Join Date: Nov 2005
Posts: 93
Thanks: 0
Thanked 2 Times in 2 Posts
Talking thanks

can I also do something against 1000 mails in the queue, except from postsupe -d ALL?

7C992372829 1000 Thu Dec 1 12:57:08 web2_rmarx@ns1.rayit.com
(connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

48491372761 1000 Thu Dec 1 12:57:05 web2_rmarx@ns1.rayit.com
(connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

4B85E372849 1000 Thu Dec 1 12:57:33 web2_rmarx@ns1.rayit.com
(delivery temporarily suspended: connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

41EB737290D 1000 Thu Dec 1 12:57:59 web2_rmarx@ns1.rayit.com
(delivery temporarily suspended: connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

63A2E37282D 1000 Thu Dec 1 12:57:08 web2_rmarx@ns1.rayit.com
(connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

69DD9372846 1000 Thu Dec 1 12:57:27 web2_rmarx@ns1.rayit.com
(delivery temporarily suspended: connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

64BA337285B 1000 Thu Dec 1 12:57:42 web2_rmarx@ns1.rayit.com
(delivery temporarily suspended: connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

6C2B7372902 1000 Thu Dec 1 12:57:53 web2_rmarx@ns1.rayit.com
(delivery temporarily suspended: connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

61F64372921 1000 Thu Dec 1 12:58:19 web2_rmarx@ns1.rayit.com
(delivery temporarily suspended: connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov

66BCE372839 1000 Thu Dec 1 12:58:22 web2_rmarx@ns1.rayit.com
(delivery temporarily suspended: connect to relay7.ucia.gov[198.81.129.186]: Connection timed out)
Admin@cia.gov



greetings

Raymond
Reply With Quote
  #4  
Old 1st December 2005, 13:12
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,460
Thanks: 813
Thanked 5,240 Times in 4,108 Posts
Default

Its "postsuper -d ALL"

I dont think there is another solution. Maybe you can write a script that deletes some mails selectively wit "postsuper -d [MAILID]".
Reply With Quote
  #5  
Old 1st December 2005, 14:00
rayit rayit is offline
Member
 
Join Date: Nov 2005
Posts: 93
Thanks: 0
Thanked 2 Times in 2 Posts
 
Default Solved..

many thanks for advise
-------------------------------------------------
mailq | tail +2 | awk 'BEGIN { RS = "" }
# $7=sender, $8=recipient1, $9=recipient2
{ if ($8 == "Admin@cia.gov" && $9 == "")
print $1 }
' | tr -d '*!' | postsuper -d -
-----------------------------------------------------
This deleted the messages..going to Admin@cia.gov

greetings

Raymond
RayIT
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
How to create FTP account bigger_travis Installation/Configuration 2 28th October 2005 10:03
where if FTP account? Hellbound General 4 9th September 2005 17:29


All times are GMT +2. The time now is 13:28.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.