邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 紧急求救，很多scan.exe和wemc.exe进程 [打印本页]

作者: lz9999 时间: 2008-4-25 03:44
标题: 紧急求救，很多scan.exe和wemc.exe进程
最近邮件服务器出了问题，有很多（200多个）scan.exe进程和wemc.exe进程，非常消耗内存，占用内存达到3000M以上，甚至不能上服务器终端进行管理。关闭了邮件服务器后，服务器上的其他网站正常。

一天的系统日志有7M多，始终找不出是什么原因，现把系统日志贴一些上来请各位高人分析一下：这些IP可全是外国的。

Wed, 23 Apr 2008 23:55:57 [85.172.43.197] 关闭Smtp连接.
Wed, 23 Apr 2008 23:55:58 [222.246.1.18] 关闭Smtp连接.
Wed, 23 Apr 2008 23:55:58 [71.180.160.88] 关闭Smtp连接.
Wed, 23 Apr 2008 23:55:59 [59.42.228.57] 关闭连接.
Wed, 23 Apr 2008 23:55:59 [222.246.1.18] 关闭连接.
Wed, 23 Apr 2008 23:55:59 [84.6.1.99] 关闭连接.
Wed, 23 Apr 2008 23:55:59 [85.172.43.197] 关闭连接.
Wed, 23 Apr 2008 23:55:59 [71.180.160.88] 关闭连接.
Wed, 23 Apr 2008 23:55:59 Smtp登录. IP: 189.60.36.124 , Port 60927
Wed, 23 Apr 2008 23:55:59 Smtp登录. IP: 116.30.90.64 , Port 2269
Wed, 23 Apr 2008 23:56:00 HELO/EHLO 主机名通过验证: ACER511EBA12DF.UNE.NET.CO
Wed, 23 Apr 2008 23:56:00 HELO/EHLO 主机名通过验证: ESTACAO04
Wed, 23 Apr 2008 23:56:01 Smtp登录. IP: 88.247.79.203 , Port 17583
Wed, 23 Apr 2008 23:56:02 [189.60.36.124] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:02 Smtp登录. IP: 121.245.39.198 , Port 22142
Wed, 23 Apr 2008 23:56:02 Smtp登录. IP: 78.36.179.127 , Port 31827
Wed, 23 Apr 2008 23:56:03 [201.233.47.191] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:04 [189.24.135.4] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:05 [121.245.39.198] 关闭连接.
Wed, 23 Apr 2008 23:56:05 [189.60.36.124] 关闭连接.
Wed, 23 Apr 2008 23:56:05 [201.233.47.191] 关闭连接.
Wed, 23 Apr 2008 23:56:05 Smtp登录. IP: 85.179.85.24 , Port 4455
Wed, 23 Apr 2008 23:56:06 HELO/EHLO 主机名通过验证: [78.36.179.127]
Wed, 23 Apr 2008 23:56:08 [189.24.135.4] 关闭连接.
Wed, 23 Apr 2008 23:56:08 接收到一封发往的邮件.
Wed, 23 Apr 2008 23:56:08 Smtp登录. IP: 88.244.43.183 , Port 2505
Wed, 23 Apr 2008 23:56:10 HELO/EHLO 主机名通过验证: F051103117.ADSL.ALICEDSL.DE
Wed, 23 Apr 2008 23:56:11 Smtp登录. IP: 189.133.171.152 , Port 1922
Wed, 23 Apr 2008 23:56:11 [116.30.90.64] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:11 HELO/EHLO 主机名通过验证: MEDICO
Wed, 23 Apr 2008 23:56:12 [189.133.171.152] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:13 [116.30.90.64] 关闭连接.
Wed, 23 Apr 2008 23:56:13 [189.133.171.152] 关闭连接.
Wed, 23 Apr 2008 23:56:14 [85.179.85.24] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:14 Smtp登录. IP: 92.113.3.172 , Port 56154
Wed, 23 Apr 2008 23:56:16 [88.247.79.203] 关闭连接.
Wed, 23 Apr 2008 23:56:16 [85.179.85.24] 关闭连接.
Wed, 23 Apr 2008 23:56:21 Smtp登录. IP: 219.134.24.26 , Port 3075

[ 本帖最后由 lz9999 于 2008-4-25 08:30 编辑 ]

作者: humbass 时间: 2008-4-25 07:20
看问题的现象以及winwebmail日志，应该是中毒的症状，为啥把中毒和winwebmail扯上关系

作者: lz9999 时间: 2008-4-25 08:10
老兄，到底是不是中毒？不太明白。

作者: lz9999 时间: 2008-4-25 08:24
清除了很多过期的邮箱，然后按官方设置了防垃圾邮件，最近的日志如下：

Fri, 25 Apr 2008 08:14:19 [70.45.119.92] 关闭连接.
Fri, 25 Apr 2008 08:14:19 [82.154.167.129] 关闭连接.
Fri, 25 Apr 2008 08:14:20 Smtp登录. IP: 121.34.105.149 , Port 2152
Fri, 25 Apr 2008 08:14:21 Smtp登录. IP: 68.153.238.51 , Port 57658
Fri, 25 Apr 2008 08:14:22 Smtp登录. IP: 70.45.119.92 , Port 1090
Fri, 25 Apr 2008 08:14:23 拒收一封邮件, 原因: 域名[shunyuan88.com]与发信IP地址[121.34.105.149]不匹配.
Fri, 25 Apr 2008 08:14:26 [121.34.105.149] 关闭连接.
Fri, 25 Apr 2008 08:14:28 [70.45.119.92] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:28 [68.153.238.51] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:29 Smtp登录. IP: 125.34.157.56 , Port 3428
Fri, 25 Apr 2008 08:14:29 拒收一封邮件, 原因: 域名[china.com]与发信IP地址[125.34.157.56]不匹配.
Fri, 25 Apr 2008 08:14:31 [70.45.119.92] 关闭连接.
Fri, 25 Apr 2008 08:14:31 [68.153.238.51] 关闭连接.
Fri, 25 Apr 2008 08:14:31 [125.34.157.56] 关闭连接.
Fri, 25 Apr 2008 08:14:36 Smtp登录. IP: 71.113.214.128 , Port 61813
Fri, 25 Apr 2008 08:14:37 Smtp登录. IP: 190.128.101.148 , Port 3394
Fri, 25 Apr 2008 08:14:40 Smtp登录. IP: 190.55.122.15 , Port 1803
Fri, 25 Apr 2008 08:14:40 [71.113.214.128] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:42 Smtp登录. IP: 71.170.147.132 , Port 2133
Fri, 25 Apr 2008 08:14:43 [71.113.214.128] 关闭连接.
Fri, 25 Apr 2008 08:14:44 Smtp登录. IP: 119.122.108.174 , Port 24121
Fri, 25 Apr 2008 08:14:45 拒收一封邮件, 原因: 域名[fuhwatrading.com]与发信IP地址[119.122.108.174]不匹配.
Fri, 25 Apr 2008 08:14:47 [71.170.147.132] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:47 [119.122.108.174] 关闭连接.
Fri, 25 Apr 2008 08:14:50 [71.170.147.132] 关闭连接.
Fri, 25 Apr 2008 08:14:51 Smtp登录. IP: 218.106.248.76 , Port 56899
Fri, 25 Apr 2008 08:14:52 [218.106.248.76] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:52 Smtp登录. IP: 71.210.164.72 , Port 3444
Fri, 25 Apr 2008 08:14:53 拒收一封邮件, 原因: 域名[borsariassociates.com]与发信IP地址[190.128.101.148]不匹配.
Fri, 25 Apr 2008 08:14:54 [218.106.248.76] 关闭连接.
Fri, 25 Apr 2008 08:14:55 Smtp登录. IP: 216.70.129.97 , Port 3005
Fri, 25 Apr 2008 08:14:55 [190.55.122.15] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:56 Smtp登录. IP: 63.111.179.165 , Port 40171
Fri, 25 Apr 2008 08:14:56 [71.210.164.72] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:58 [190.55.122.15] 关闭连接.
Fri, 25 Apr 2008 08:14:58 [190.128.101.148] 关闭连接.
Fri, 25 Apr 2008 08:14:58 [216.70.129.97] 关闭连接.
Fri, 25 Apr 2008 08:14:58 [71.210.164.72] 关闭连接.
Fri, 25 Apr 2008 08:15:02 [63.111.179.165] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:02 Smtp登录. IP: 218.91.234.158 , Port 52076
Fri, 25 Apr 2008 08:15:04 [63.111.179.165] 关闭连接.
Fri, 25 Apr 2008 08:15:05 拒收一封邮件, 原因: 域名[nle.com]与发信IP地址[218.91.234.158]不匹配.
Fri, 25 Apr 2008 08:15:08 [218.91.234.158] 关闭连接.
Fri, 25 Apr 2008 08:15:10 Smtp登录. IP: 189.82.56.237 , Port 2680
Fri, 25 Apr 2008 08:15:12 Smtp登录. IP: 206.46.172.63 , Port 54955
Fri, 25 Apr 2008 08:15:15 [206.46.172.63] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:15 [189.82.56.237] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:16 Smtp登录. IP: 218.18.198.51 , Port 4402
Fri, 25 Apr 2008 08:15:17 [218.18.198.51] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:18 [206.46.172.63] 关闭连接.
Fri, 25 Apr 2008 08:15:18 [189.82.56.237] 关闭连接.
Fri, 25 Apr 2008 08:15:18 [218.18.198.51] 关闭连接.
Fri, 25 Apr 2008 08:15:20 Smtp登录. IP: 92.74.113.7 , Port 3968
Fri, 25 Apr 2008 08:15:24 Smtp登录. IP: 60.171.142.153 , Port 50454
Fri, 25 Apr 2008 08:15:25 Smtp登录. IP: 216.129.90.205 , Port 41307
Fri, 25 Apr 2008 08:15:25 [92.74.113.7] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:26 拒收一封邮件, 原因: 域名[mail.ttlc.net]与发信IP地址[60.171.142.153]不匹配.
Fri, 25 Apr 2008 08:15:28 [216.129.90.205] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:28 [92.74.113.7] 关闭连接.
Fri, 25 Apr 2008 08:15:28 [60.171.142.153] 关闭连接.
Fri, 25 Apr 2008 08:15:28 [216.129.90.205] 关闭连接.
Fri, 25 Apr 2008 08:15:33 Smtp登录. IP: 201.223.20.206 , Port 29343
Fri, 25 Apr 2008 08:15:34 Smtp登录. IP: 71.105.61.183 , Port 50185
Fri, 25 Apr 2008 08:15:35 Smtp登录. IP: 125.78.49.13 , Port 41175
Fri, 25 Apr 2008 08:15:37 Smtp登录. IP: 125.34.148.128 , Port 2068
Fri, 25 Apr 2008 08:15:37 拒收一封邮件, 原因: 域名[bigfoot.com]与发信IP地址[125.34.148.128]不匹配.
Fri, 25 Apr 2008 08:15:39 [71.105.61.183] 关闭连接.
Fri, 25 Apr 2008 08:15:39 [125.34.148.128] 关闭连接.
Fri, 25 Apr 2008 08:15:39 拒收一封邮件, 原因: 域名[a-tsurgical.com]与发信IP地址[125.78.49.13]不匹配.

作者: lz9999 时间: 2008-4-25 08:25
域名[a-tsurgical.com]与发信IP地址[125.78.49.13]不匹配

这个不太明白是什么意思

作者: rayer 时间: 2008-4-28 14:51
就是说那这家伙伪造域名发信

作者: smmwj 时间: 2008-4-28 19:02
这个是别人利用你的服务器往外发垃圾邮件。每一封邮件一跳出来就会启用SCAN查毒。就占用资源造成很多进程，你是用MCAFEE作邮件防毒的吧。版本是不是8。0或以前的？你升级到8.5I应该就没问题了

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.net/)