看日志，对于这种*意垃圾邮件如何防范？

huanghuhai

SMTP日志如下，最近本公司Exchange2003每天收到大量含病毒附件的垃圾邮件，而且估计它们用用户字典功能，有被猜中本域地址的有没中的，我已经装了卡巴斯基，连病毒尸体也一起干掉了，可是，我希望Exchange2003能阻拦，假如不用第三方软硬件的情况下，如何应对？<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 27, 29, 250, 0, RCPT, -, TO: <lijihong@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 28, 30, 250, 0, RCPT, -, TO: <hjczy4644@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 23, 25, 250, 0, RCPT, -, TO: <wang@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 32, 34, 250, 0, RCPT, -, TO: <wanghanhui519@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 31, 33, 250, 0, RCPT, -, TO: <wangyaxin705@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 32, 34, 250, 0, RCPT, -, TO: <xinghongchang@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 33, 35, 250, 0, RCPT, -, TO: <hongchangqipei@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 33, 35, 250, 0, RCPT, -, TO: <renxiaohui2005@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 31, 33, 250, 0, RCPT, -, TO: <chenheng0720@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 24, 26, 250, 0, RCPT, -, TO: <zycxs@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:20, SMTPSVC1, EXSERVER, 10.160.0.3, 1484, 76864, 119, 250, 0, DATA, -, <4ef735d44baf3db247a@adbhppabg.com>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:20, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 4, 61, 240, 10766, QUIT, -, unefp.com,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:31, SMTPSVC1, EXSERVER, 10.160.0.3, 2937, 16, 41, 250, 0, HELO, -, cokiowe.com,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:31, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 28, 40, 250, 0, MAIL, -, FROM: <office@xbry.com>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:31, SMTPSVC1, EXSERVER, 10.160.0.3, 766, 25, 0, 250, 0, RCPT, -, TO: <xingyf@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:31, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 31, 33, 250, 0, RCPT, -, TO: <wanganhui519@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 25, 27, 250, 0, RCPT, -, TO: <azg212@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 26, 28, 250, 0, RCPT, -, TO: <zgb-002@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 29, 31, 250, 0, RCPT, -, TO: <junxie1234@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 30, 32, 250, 0, RCPT, -, TO: <liuqing_zyc@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 25, 27, 250, 0, RCPT, -, TO: <fyqfyz@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 25, 27, 250, 0, RCPT, -, TO: <HZJ207@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 32, 34, 250, 0, RCPT, -, TO: <zhangjie_1962@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 34, 36, 250, 0, RCPT, -, TO: <Huangyuping1963@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 24, 26, 250, 0, RCPT, -, TO: <mq_sm@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 25, 27, 250, 0, RCPT, -, TO: <mdjyyw@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 28, 30, 250, 0, RCPT, -, TO: <wangyaxin@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 34, 36, 250, 0, RCPT, -, TO: <xinhongchangljs@本域>,<br>
61.149.105.234, cokiowe.com, 2005-12-5, 18:28:32, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 22, 24, 250, 0, RCPT, -, TO: <yte@本域>,

FirstWe

安装Sybari的Antigen for Exchange试一试吧，应该会有效果！<br>
但请别问我哪里有D版的！！！

bgg518

是啊，请高人指点一下吧，明知道都是Sober惹的祸，可是无法彻底清楚掉啊，我这里现在已经是第4次，病毒邮件泛滥了，之前病毒邮件泛滥两三天后，情况会好转一些，可是过不了几天就再次发作，我看资料，安装杀毒软件，把网内电脑全部清查，可没效果，这次Sober病毒发作已经四天了，没有一点的好转迹象。请高人指点一下，谢谢。

wanhengchao

我们公司的也有这样的情况啊，好象用NT可以解决的，以前一天10几封，现在我们把公司所有的机器都杀了一个遍，可能还是有漏网之鱼，现在每天还是收到1-2封

Jobsz

我们打算启用GFI的套装包.

yyyfffqqq

版主<br>
这个问题好好的现在多,都是W32.Sober.X@mm病毒引起的.<br>
我公司的作法.封IP,作用SMTP筛选.但是还是有一点点(只有几个用户的能收到邮件)不行.<br>
我的网络结构是 mail win2k3+exchange2k3<br>ISA win2k3+isa2004.<br>
有没有好的方法解决.

alone-rain

不太明白你的网络结构，从你的日志上来看都是一个固定IP发过来的啊，封掉不就得了？我听不明白你说外网IP中毒太深是什么意思，也不明白你的网络结构，所以不是太清楚。<br>
你先要确定病毒来自哪个网段，同时祷告内网没有中毒，否则你搞了还会白搞。找个时间建立新SMTP日志，然后分别断掉外网和内网连接，分析日志，大概就明白病毒来自哪里了。内网有毒就杀毒，外网的话，能封就封，不能封那就只好这样忍受罗！如果外网也是你们的服务器或者网关，杀毒罗。<br>
不明白你的卡巴死机连病毒尸体就清掉了你还担心什么啊？用户又感觉不到，又看不到。如果人家就是要发垃圾病毒邮件给你，而你又没办法封人家IP，除了投诉还能怎么样？忍受吧，不在沉默中爆发，就在沉默中死亡。。。。。。。

bluesky_007

大俠,封主題封ip我也有在做,但ip在不斷增加!網絡病毒實在太利害,大家祈禱吧

bluesky_007

為了此情況,公司內的電腦都跑了一遍,客戶端防毒軟件,都已經安裝好了,服務器們每天都有查毒,但還是無功而返<img src="../leadbbsfile/UBBicon/em12.GIF" width=20 height=20 align=absmiddle border=0><br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 32, 34, 250, 0, RCPT, -, TO: <xinghongchang@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 33, 35, 250, 0, RCPT, -, TO: <hongchangqipei@本域>,<br>
61.149.105.234, unefp.com, 2005-12-5, 17:56:18, SMTPSVC1, EXSERVER, 10.160.0.3, 0, 33, 35, 250, 0, RCPT, -, TO: <renxiaohui2005@本域><br>
以上記錄通訊ip(61.149.105.234)是外網ip,而且還alive!此類ip而且還不斷更新,不知是內部pc中病毒,還是外網ip中毒太深!如果是外網電腦中毒,那exchange 2000不知怎麼防好,已經困擾好幾天啦,還請大家幫幫忙!ths

文文

有点麻烦，可能要在服务端和客户端都做好病毒防护，否则不好搞