Spam
在網路上定位惡意軟體
我正在嘗試隔離在我的網路上發送惡意軟體的電子郵件。標題如下:
Received: from z.local.domain (172.18.248.22) by z.local.domain (172.18.248.22) with Microsoft SMTP Server (TLS) id 15.0.712.24 via Mailbox Transport; Mon, 30 Sep 2013 02:35:43 -0700 Received: from z.local.domain (172.18.248.22) by z.local.domain (172.18.248.22) with Microsoft SMTP Server (TLS) id 15.0.712.24; Mon, 30 Sep 2013 02:35:43 -0700 Received: from localhost (172.18.248.18) by z.local.domain (172.18.248.22) with Microsoft SMTP Server (TLS) id 15.0.712.24 via Frontend Transport; Mon, 30 Sep 2013 02:35:43 -0700 Received: from www-data by localhost with local (Exim 4.80) (envelope-from <www-data@local.domain>) id 1VQZtH-0002oq-13 for helpdesk@local.domain; Mon, 30 Sep 2013 02:35:43 -0700 MIME-Version: 1.0 Subject: Subject: eRKpqkSHqdjESMjhqQ Return-Path: www-data@local.domain X-MS-Exchange-Organization-Authsource: z.local.domain Date: Mon, 30 Sep 2013 02:35:43 -0700 X-MS-Exchange-Organization-Network-Message-ID: d786a17d-ef12-4403-aa12-08d08bd7914a X-MS-Exchange-Organization-Authas: Anonymous content-type: text/html; charset="utf-8" Message-ID: <E1VQZtH-0002oq-13@localhost> To: <helpdesk@local.domain> X-PHP-Originating-Script: 0:ticket.php From: Benjamin <goodsam@gmail.com> X-RT-Original-Encoding: iso-8859-1 Content-Length: 500
我已經用clamwin 和malwarebytes 掃描了Z 伺服器,但都返回了否定的結果。除了幫助台之外,似乎沒有其他人在我們的網路中報告過這種垃圾郵件。(Helpdesk 位於執行 Request Tracker 4 的 Debian 7.1 主機上 - 這是檢查此電子郵件帳戶的唯一位置。)
我可以在 Z 伺服器上執行任何其他掃描器還是問題出在其他地方?
您的標頭顯示此郵件來自 172.18.248.18。這就是您需要查看的機器。