Koozali.org: home of the SME Server

Legacy Forums => General Discussion (Legacy) => Topic started by: Derek on May 03, 2004, 08:59:04 PM

Title: Is my system compromised
Post by: Derek on May 03, 2004, 08:59:04 PM

I dont know much about reading the logs but I am seeing email which appears to be coming from me. I am also a recipient of emails from this account.


1083606401.554848500 qp 24967: from=<corporatesales-return-35-sales=mydomain.com@computertrends.com>, uid=400, size=2484, nrcpts=1, deferrals=0, qtime=0.012793
1083606412.464050500 qp 24992: to=local.alias-localdelivery-sales@mydomain.com, uid=401, ddelay=1.644114, xdelay=1.641012, stat=Sent (forward:_qp_25014/did_0+0+1/)

I put "mydomain" where my real domain was for the
purpose of this posting.
Computertrends is not me.

thanks

Derek

Title: Is my system compromised
Post by: RavenIV on May 04, 2004, 01:55:24 AM

your system is not "hacked".
many viruses steal email-adresses and put them as sender or receipt in their fake-emails.

ignore or delete those emails and your network will be clean.

cheers klaus

Title: Is it hacked
Post by: Derek on May 04, 2004, 04:02:02 AM

Thanks for the advice

Derek

Title: Still curious
Post by: Derek on May 04, 2004, 05:05:02 AM

This info from my log is my only other concern.
I really dont believe I send this volume of email so where are these numbers coming from?

Completed messages: 8274
Recipients for completed messages: 8743
Total delivery attempts for completed messages: 11803
Average delivery attempts per completed message: 1.42652
Bytes in completed messages: 270603640
Bytes weighted by success: 325346512
Average message qtime (s): 5438.65

Total delivery attempts: 12111
  success: 7236
  failure: 1507
  deferral: 3368