Sehr großes Problem!

infernus

infernus

Registered User
Hallo,

wie der Titel des Threads schon verrät, habe ich ein riesen Problem mit meinem Server.
Und zwar, bekomme ich seit einer halben Stunde Spam von meinem eigenen Server.
Es kommen irgendwelche wirren E-Mails an, ca. 300 Mails in 5 Minuten.
Das ist echt heftig.
Ich habe meinen Server momentan ausgeschaltet, da ich so viel Spam in meinem WEB.de Postfach nicht vertragen kann.

E-Mails wie die hier:


Betreff: Delivery Status Notification (Failure)
Von: postmaster@wv.gov
An: web1@confixx.gbs4u.de
Datum: 05.03.09 22:12:11 Uhr

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

Thomas.R.Strawderman@wv.gov


Ich brauche echt drigend hilfe!
 
Also erstmal ruhig Blut.

Bitte erstmal den Server im Rescue Mode booten und dann alle Log Files sichern und auswerten. Entsprechende Ausschnitte aus der maillog kannst du dann hier mal posten damit wir genaue Infos haben. Ansonsten müssten wir nur raten woran es liegt, und das hilft keinem weiter.

Also Infos, Infos, Infos!!! OS? MTA? Alle Infos helfen weiter :-)
 
1. Openrelay (google suchen, checken)
2. Mta beenden, Logs lesen

Ohne jetzt deinen Content zu kennen, schätz ich mal die chance auf über 90%, dass es ich um ein Kontaktformular oder ein Outdated cms handelt.

grep mal deine Webdaten nach mail(
 
Hallo,

erstmal vielen Dank für eure Antworten.
Hier 3 der aktuellen E-Mails:

Code: 
The original message was received at Sun, 8 Mar 2009 12:04:56 -0400
from static.113.176.46.78.clients.your-server.de [78.46.176.113]


*** ATTENTION ***

Your e-mail is being returned to you because there was a problem with its
delivery. The address which was undeliverable is listed in the section
labeled: "----- The following addresses had permanent fatal errors -----".

The reason your mail is being returned to you is listed in the section
labeled: "----- Transcript of Session Follows -----".

The line beginning with "<<<" describes the specific reason your e-mail could
not be delivered. The next line contains a second error message which is a
general translation for other e-mail servers.

Please direct further questions regarding this message to your e-mail
administrator.

--AOL Postmaster



----- The following addresses had permanent fatal errors -----
<mstjmorris@aol.com>
(reason: 552 mstjmorris MAILBOX FULL)
<mstrmastiff@aol.com>
(reason: 550 mstrmastiff IS NOT ACCEPTING MAIL FROM THIS SENDER)

----- Transcript of session follows -----
... while talking to air-dd05.mail.aol.com.:
>>> RCPT To:<mstrmastiff@aol.com>
<<< 550 mstrmastiff IS NOT ACCEPTING MAIL FROM THIS SENDER
550 5.1.1 <mstrmastiff@aol.com>... User unknown
>>> RCPT To:<mstjmorris@aol.com>
<<< 552 mstjmorris MAILBOX FULL
554 5.0.0 Service unavailable


<hr>
Received: from confixx.gbs4u.de (static.113.176.46.78.clients.your-server.de [78.46.176.113]) by rly-dd07.mx.aol.com (v123.3) with ESMTP id MAILRELAYINDD072-b8849b3eca633b; Sun, 08 Mar 2009 12:04:56 -0400
Received: by confixx.gbs4u.de (Postfix, from userid 647)
id AB607AE08F2F; Thu, 5 Mar 2009 19:48:34 +0000 (UTC)
To: 
Subject: Re: Investments Projects with your Company.
From: "Stanislav Volodymir" <oilplant@gbs4u.de>
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="--Boundary-=_ed14d064a18e7597644322fbc59dc321"
X-Mailer: b1gMail (www.b1g.info)
Message-Id: <20090305194834.AB607AE08F2F@confixx.gbs4u.de>
Date: Thu, 5 Mar 2009 19:48:34 +0000 (UTC)
X-AOL-IP: 78.46.176.113
X-AOL-SCOLL-SCORE:0:2:282762304:93952408
X-AOL-SCOLL-URL_COUNT:0

Code: 
This is the mail system at host confixx.gbs4u.de.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

<details.stanley3903@gmail.com>: host gmail-smtp-in.l.google.com[209.85.129.27]
said: 550-5.1.1 The email account that you tried to reach does not exist.
Please 550-5.1.1 try double-checking the recipient's email address for
typos 550-5.1.1 or unnecessary spaces. Learn more at
550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596
d13si677392fka.0 (in reply to RCPT TO command)

<deburgh@bigpond.com>: host extmail.bigpond.com[61.9.168.122] said: 550 Invalid
recipient: <deburgh@bigpond.com> (in reply to RCPT TO command)

<denjoan2@bigpond.net.au>: host extmail.bpbb.bigpond.com[61.9.168.122] said:
550 Invalid recipient: <denjoan2@bigpond.net.au> (in reply to RCPT TO
command)


<hr>


Code: 
User mailbox exceeds allowed size: dixie@sd-software.com


Original message follows.

Received: from smtpgate.ndunet.com [162.42.148.100] by pc.ndunet.com with ESMTP
(SMTPD32-8.15) id A08610FD0042; Thu, 05 Mar 2009 21:13:42 +0000
Received: by smtpgate.ndunet.com (Postfix, from userid 58)
id 83DA7284D7; Thu, 5 Mar 2009 21:13:42 +0000 (UTC)
X-Spam-Flag: NO
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10)
X-Spam-Level: x
X-Spam-Status: Reqd:5.0 Hits:1.8 Learn:disabled Tests:MIME_QP_LONG_LINE=1.819
Received: from confixx.gbs4u.de (static.113.176.46.78.clients.your-server.de [78.46.176.113])
by smtpgate.ndunet.com (Postfix) with ESMTP id 9D003284E3
for <dixie@sd-software.com>; Thu, 5 Mar 2009 21:13:40 +0000 (UTC)
Received: by confixx.gbs4u.de (Postfix, from userid 647)
id C93FDAE08F2B; Thu, 5 Mar 2009 20:00:26 +0000 (UTC)
To: 
Subject: Re: Investments Projects with your Company.
From: "Stanislav Volodymir" <oilplant@gbs4u.de>
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="--Boundary-=_a0655b0776017e36a65070d568757faa"
X-Mailer: b1gMail (www.b1g.info)
Message-Id: <20090305200026.C93FDAE08F2B@confixx.gbs4u.de>
Date: Thu, 5 Mar 2009 20:00:26 +0000 (UTC)
X-Virus-Scanned: ClamAV 0.94.2/9074/Thu Mar 5 15:21:02 2009 on smtpgate.ndunet.com
X-Virus-Status: Clean

----Boundary-=_a0655b0776017e36a65070d568757faa
Content-Type: text/plain ; CHARSET=iso-8859-1
Content-Transfer-Encoding: quoted-printable

March 5, 2009


Attn Sir,


I am looking for your co-operation in building a Tourist Hotel/shopping Mall and also would be interested in investing into your Manufacturing and Productions in your Continent Asia or Even the United States. I need an experienced company like yours to assist me in setting up, develop these projects and assume responsibility as chairman and also ensure that your government/authorities do not take advantage of these projects either through TAX or other means. A return on profit (ROI) will be distributed monthly or annually depending on our agreement.

Upon confirming the receipt of this letter, my attorney will confirm with your chambers of commerce
[message truncated]


Habe den Apache2 Log als .TXT Datei angehängt.
Hoffe das hilft euch weiter.

Wenn Ihr noch irgendwas bestimmtes braucht, dann sagt es bitte.
 

Attachments

Last edited by a moderator:
chris085 said:
1. Openrelay (google suchen, checken)
2. Mta beenden, Logs lesen

Ohne jetzt deinen Content zu kennen, schätz ich mal die chance auf über 90%, dass es ich um ein Kontaktformular oder ein Outdated cms handelt.

grep mal deine Webdaten nach mail(
Click to expand...

z.B.:
Code: 
rgrep -i 'mail(' /path/to/htdocs
grep -i '=http' /path/to/access.log
grep -i allow_url_include /path/to/php.ini

Letzteres sollte auf off stehen.

z.B.:
Code: 
zgrep -i '=http' /var/log/apache2/*access.log*
 
Last edited by a moderator:
Hallo,

ich habe alles durchgeführt was Ihr mir vorgeschlagen habt, leider ohne erfolg.
Es kamen immer weiter Spammails rein.
Also habe ich den sauren Apfel gebissen und den User web1 gelöscht.
Vorher hatte ich natürlich den User web2 angelegt gehabt.
Und aufeinmal hörte der Spam auf.
Ist zwar eine sehr plumpe Lösung, doch es musste leider schnell eine Lösung her.
Nochmal vielen Dank für eure Tipps!

Ihr könnt den Thread jetzt schließen.



Gruß Rene
 
Da bist du aber dein Problem nur umgangen. du weißt aber immer noch nicht, wer den Spam wirklich verschickt hat, und worüber das passiert ist. Das ganze wird wieder passieren, wenn du nicht die fehlerhaften dinge änderst.
 
You must log in or register to reply here.
Back
Top