não entendi esse log que você colou. Mas com com autenticação no smtp aparece de quem partiu a conexão, exemplo:
[r...@correio log]# cat maillog | grep B31C677988F Sep 16 09:03:27 correio nss_wins[22959]: B31C677988F:*client=unknown[189.101.94.103] *, sasl_method=PLAIN,* sasl_username=gabriel* Sep 16 09:03:27 correio postfix/cleanup[23425]: B31C677988F: message-id=< [email protected]> Sep 16 09:03:27 correio postfix/qmgr[21412]: B31C677988F: from=< [email protected]>, size=888, nrcpt=3 (queue active) Sep 16 09:03:27 correio postfix/local[21407]: B31C677988F: to=< [email protected]>, relay=local, delay=0.09, delays=0.05/0/0/0.03, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail) Sep 16 09:03:27 correio postfix/qmgr[21412]: B31C677988F: removed Att, *Gabriel Ricardo* *MSN:* [email protected] http://tinotapa.blogspot.com http://twitter.com/gricardo87 2010/9/16 Fábio Bonatto <[email protected]> > Srs, boa noite > > Alguem conhece o script DarkMailer/Yellsoft e como ele trabalha? > > Segundo a SPAMCOP eu estou com este trojan na minha rede, utilizando > meu servidor , e nos logs não me aparece a estacao que estao > infectada. > > LOG: > O trojan utiliza varios servidores p/ envio. > > Sep 15 06:25:46 firewall postfix/smtpd[26944]: connect from > smtp-cpk.frontbridge.com[204.231.192.41] > Sep 15 06:25:46 firewall postfix/smtpd[26943]: NOQUEUE: reject: RCPT > from mail.genbank.ru[212.176.125.145]: 450 4.7.1 > <[email protected]>: Recipient address rejected: > Greylisted, see > http://isg.ee.ethz.ch/tools/postgrey/help/meudominio.com.br.html; > from=<> to=<LaveraRosenbluth86 > [email protected]> proto=ESMTP helo=<mail.genbank.ru> > _______________________________________________ > Postfix-BR mailing list > [email protected] > http://listas.softwarelivre.org/mailman/listinfo/postfix-br > _______________________________________________ Postfix-BR mailing list [email protected] http://listas.softwarelivre.org/mailman/listinfo/postfix-br
