Dear P' Syafril, pagi ini saya mendapatkan kejadian yang cukup aneh,
Postmaster E-mail server factory mendapatkan message seperti terlampir di
attachment, hampir semua e-mail yang lalulintas di e-mail server factory
Masuk ke quarantine karena dianggap tidak dapat di scan, contoh potongan
logsnya sebagai berikut : (saya mengambil dari all log) :
============================================================================
Session 9715; child 1; thread 388
Thu 2007-05-03 09:21:55: Accepting SMTP connection from [127.0.0.1 : 2780]
Thu 2007-05-03 09:21:55: --> 220 aio.co.id ESMTP MDaemon 9.5.6; Thu, 03 May
2007 09:21:55 +0700
Thu 2007-05-03 09:21:55: <-- EHLO WorldClient
Thu 2007-05-03 09:21:55: --> 250-aio.co.id Hello WorldClient, pleased to
meet you
Thu 2007-05-03 09:21:55: --> 250-ETRN
Thu 2007-05-03 09:21:55: --> 250-AUTH=LOGIN
Thu 2007-05-03 09:21:55: --> 250-AUTH LOGIN CRAM-MD5
Thu 2007-05-03 09:21:55: --> 250-8BITMIME
Thu 2007-05-03 09:21:55: --> 250 SIZE 0
Thu 2007-05-03 09:21:55: <-- AUTH CRAM-MD5
Thu 2007-05-03 09:21:55: --> 334
PE1EQUVNT04tRjIwMDcwNTAzMDkyMS5BQTIxNTU4MDVNRDAwMTJAYWlvLmNvLmlkPg==
Thu 2007-05-03 09:21:55: <--
Y2VudGVyQGFpby5jby5pZCBjZDczMWVhMmZjMjYwNWQ0YjNlYmI3Njg5YmUzZmMyYQ==
Thu 2007-05-03 09:21:55: --> 235 Authentication successful
Thu 2007-05-03 09:21:55: Authenticated as [EMAIL PROTECTED]
Thu 2007-05-03 09:21:55: <-- MAIL FROM: <[EMAIL PROTECTED]> SIZE=1471863
Thu 2007-05-03 09:21:55: --> 250 <[EMAIL PROTECTED]>, Sender ok
Thu 2007-05-03 09:21:55: <-- RCPT TO: <[EMAIL PROTECTED]>
Thu 2007-05-03 09:21:55: --> 250 <[EMAIL PROTECTED]>, Recipient ok
Thu 2007-05-03 09:21:55: <-- DATA
Thu 2007-05-03 09:21:55: Creating temp file (SMTP):
c:\mdaemon\queues\temp\md50000005932.tmp
Thu 2007-05-03 09:21:55: --> 354 Enter mail, end with <CRLF>.<CRLF>
Thu 2007-05-03 09:21:55: Message size: 1471865 bytes
Thu 2007-05-03 09:21:55: Passing message through AntiVirus (Size:
1471865)...
Thu 2007-05-03 09:21:55: * Message could not be scanned
Thu 2007-05-03 09:21:55: ---- End AntiVirus results
Thu 2007-05-03 09:21:55: Message creation successful:
c:\mdaemon\queues\inbound\md50000009954.msg
Thu 2007-05-03 09:21:55: --> 250 Ok, message saved <Message-ID:
[EMAIL PROTECTED]>
Thu 2007-05-03 09:21:55: <-- QUIT
Thu 2007-05-03 09:21:55: --> 221 See ya in cyberspace
Thu 2007-05-03 09:21:55: SMTP session successful (Bytes in/out: 1472060/529)
Thu 2007-05-03 09:21:55: ----------
Thu 2007-05-03 09:21:56: Processing message:
c:\mdaemon\queues\inbound\md50000009954.msg
Thu 2007-05-03 09:21:56: From: [EMAIL PROTECTED]; Recipient:
[EMAIL PROTECTED]; Size: 1471865; Message:
c:\mdaemon\queues\local\md35000018657.msg
Thu 2007-05-03 09:21:56: Subject: logs
Thu 2007-05-03 09:21:56: Message-ID:
[EMAIL PROTECTED]
Thu 2007-05-03 09:21:56: ----------
Thu 2007-05-03 09:21:57: SecurityPlus AntiVirus processing
c:\mdaemon\queues\local\md35000018657.msg...
Thu 2007-05-03 09:21:57: > Message return-path: [EMAIL PROTECTED]
Thu 2007-05-03 09:21:57: > Message from: [EMAIL PROTECTED]
Thu 2007-05-03 09:21:57: > Message to: [EMAIL PROTECTED]
Thu 2007-05-03 09:21:57: > Message subject: logs
Thu 2007-05-03 09:21:57: > Message ID:
<[EMAIL PROTECTED]>
Thu 2007-05-03 09:21:57: Start SecurityPlus AntiVirus results
Thu 2007-05-03 09:21:57: * pd266384743.hdr could not be scanned
Thu 2007-05-03 09:21:57: * Total attachments scanned : 0 (including
multipart/alternatives and message body)
Thu 2007-05-03 09:21:57: * Total attachments infected : 0
Thu 2007-05-03 09:21:57: * Total attachments disinfected: 0
Thu 2007-05-03 09:21:57: * Total errors while scanning : 1
Thu 2007-05-03 09:21:57: * Message moved to
c:\mdaemon\cfilter\quarant\md50000000101.msg
Thu 2007-05-03 09:21:57: * Virus notification sent to [EMAIL PROTECTED]
(admin)
Thu 2007-05-03 09:21:57: End of SecurityPlus AntiVirus results
Thu 2007-05-03 09:21:57: ----------
Thu 2007-05-03 09:21:57: ----------
Thu 2007-05-03 09:21:58: [RAW] Converting
<C:\MDaemon\Queues\Raw\md50000000376.raw>
Thu 2007-05-03 09:21:58: [RAW] From: [EMAIL PROTECTED]
Thu 2007-05-03 09:21:58: [RAW] To: [EMAIL PROTECTED]
Thu 2007-05-03 09:21:58: [RAW] Subject: MDaemon Warning - Virus Found
Thu 2007-05-03 09:21:58: [RAW] Message-ID:
<[EMAIL PROTECTED]>
Thu 2007-05-03 09:21:58: [RAW] Conversion completed (created
c:\mdaemon\queues\local\md75000018658.msg)
Thu 2007-05-03 09:21:58: ----------
Thu 2007-05-03 09:21:59: SecurityPlus AntiVirus processing
c:\mdaemon\queues\local\md75000018658.msg...
Thu 2007-05-03 09:21:59: > Message return-path:
Thu 2007-05-03 09:21:59: > Message from: [EMAIL PROTECTED]
Thu 2007-05-03 09:21:59: > Message to: [EMAIL PROTECTED]
Thu 2007-05-03 09:21:59: > Message subject: MDaemon Warning - Virus Found
Thu 2007-05-03 09:21:59: > Message ID:
<[EMAIL PROTECTED]>
Thu 2007-05-03 09:21:59: Start SecurityPlus AntiVirus results
Thu 2007-05-03 09:21:59: * pd914214939.txt could not be scanned
Thu 2007-05-03 09:21:59: * Total attachments scanned : 0 (including
multipart/alternatives and message body)
Thu 2007-05-03 09:21:59: * Total attachments infected : 0
Thu 2007-05-03 09:21:59: * Total attachments disinfected: 0
Thu 2007-05-03 09:21:59: * Total errors while scanning : 0
Thu 2007-05-03 09:21:59: * Total attachments removed : 0
Thu 2007-05-03 09:21:59: End of SecurityPlus AntiVirus results
============================================================================
Kira - kira kenapa ya pak, kejadiannya baru pagi ini,
Mohon pencerahannya.
Best Regards,
Slamet Raharjo
IT Dept.
--
--[MDaemon-L]------------------------------------------------
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.
Mohon tidak posting dengan format HTML, pastikan selalu menggunakan Format
Plain-text
Arsip : <http://mdaemon-l.dutaint.com>
Henti Langgan : <mailto:[EMAIL PROTECTED]>
Berlangganan : <mailto:[EMAIL PROTECTED]>
Versi Terakhir : MD 9.5.6, MDSP 3.0.4, MDOC 2.1.5
--- Begin Message ---
------------------------------------------------------------------------
SecurityPlus for MDaemon has detected virus infected message attachments
------------------------------------------------------------------------
>From : [EMAIL PROTECTED]
To : [EMAIL PROTECTED]
Subject : Next Purchase Order PF 22.8g
Date : Thu, 3 May 2007 09:09:57 +0700
Message-ID:
----------------------------------------------------------------------------
--
Attachment Virus name Action taken
----------------------------------------------------------------------------
--
pd3144417162.hdr NOT_SCANNED Message Quarantined
--- End Message ---
--- Begin Message ---
------------------------------------------------------------------------
SecurityPlus for MDaemon has detected virus infected message attachments
------------------------------------------------------------------------
>From : [EMAIL PROTECTED]
To : [EMAIL PROTECTED]
Subject : Next Purchase Order PF 22.8g
Date : Thu, 3 May 2007 09:09:57 +0700
Message-ID:
----------------------------------------------------------------------------
--
Attachment Virus name Action taken
----------------------------------------------------------------------------
--
pd3108514485.hdr NOT_SCANNED Message Quarantined
--- End Message ---
--- Begin Message ---
------------------------------------------------------------------------
SecurityPlus for MDaemon has detected virus infected message attachments
------------------------------------------------------------------------
>From :
[EMAIL PROTECTED]
To : [EMAIL PROTECTED]
Subject : Re: [Diskusi HRD Forum] KPI untuk IT Manager
Date : Thu, 3 May 2007 07:56:06 +0800 (CST)
Message-ID: <[EMAIL PROTECTED]>
----------------------------------------------------------------------------
--
Attachment Virus name Action taken
----------------------------------------------------------------------------
--
pd750330556.hdr NOT_SCANNED Message Quarantined
--- End Message ---
--- Begin Message ---
------------------------------------------------------------------------
SecurityPlus for MDaemon has detected virus infected message attachments
------------------------------------------------------------------------
>From :
[EMAIL PROTECTED]
To : [EMAIL PROTECTED]
Subject : Re: [JUG-Indonesia] David Van Couvering: JPA and Rollbacks - Not
Pretty
Date : Wed, 2 May 2007 19:17:53 -0700
Message-ID: <[EMAIL PROTECTED]>
----------------------------------------------------------------------------
--
Attachment Virus name Action taken
----------------------------------------------------------------------------
--
pd3261029477.hdr NOT_SCANNED Message Quarantined
--- End Message ---
--- Begin Message ---
------------------------------------------------------------------------
SecurityPlus for MDaemon has detected virus infected message attachments
------------------------------------------------------------------------
>From : [EMAIL PROTECTED]
To : [EMAIL PROTECTED]
Subject : FW:
Date : Thu, 3 May 2007 09:38:44 +0700
Message-ID:
<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAA10wzqjJPVkixZawNBG65LMKAAAAQ
[EMAIL PROTECTED]>
----------------------------------------------------------------------------
--
Attachment Virus name Action taken
----------------------------------------------------------------------------
--
pd2667817353.hdr NOT_SCANNED Message Quarantined
--- End Message ---
--- Begin Message ---
------------------------------------------------------------------------
SecurityPlus for MDaemon has detected virus infected message attachments
------------------------------------------------------------------------
>From : [EMAIL PROTECTED]
To : [EMAIL PROTECTED]
Subject : logs
Date : Thu, 03 May 2007 09:21:55 +0700
Message-ID: <[EMAIL PROTECTED]>
----------------------------------------------------------------------------
--
Attachment Virus name Action taken
----------------------------------------------------------------------------
--
pd266384743.hdr NOT_SCANNED Message Quarantined
--- End Message ---
