Eric,
Thanks. I have run a complete scan of the whole machine and not
found any other instances. If there are more, at least I will catch them.
Let's see what happens from here.
Cheers and thanks for your support.
-----Original Message-----
From: Eric Shubert [mailto:[email protected]]
Sent: Wednesday, 13 April 2011 1:17 AM
To: [email protected]
Subject: [qmailtoaster] Re: Perl Bot
I think it's most likely came from messages that were copied over. I
would try to run Sophos against everything under
/home/vpopmail/domains/. That should clean things up.
I don't know of any web anomaly. Just be sure to take normal
precautions, such as requiring ssl. Be sure that no passwords are
transmitted in the clear.
--
-Eric 'shubes'
On 04/11/2011 07:16 PM, Mike Canty wrote:
> Eric,
> We do have clamav installed and operational, but I agree this could
> be from something already in a mailbox. When we configured this machine
we
> copied a lot of messages from POP accounts to IMAP.
>
> The tmp directory also has "m", "m.1", "m.2" as well as "dude.txt" and all
> are infected.
>
> If this is already here, obviously we cannot check it, but I need to make
> sure we do not get any others. So ClamAV should find them, correct.
Could
> they arrive via Web anomaly? We only have the Qmail-Toaster Admin and
> Webmail active on this machine.
>
> Cheers
>
> -----Original Message-----
> From: Eric Shubert [mailto:[email protected]]
> Sent: Tuesday, 12 April 2011 10:05 AM
> To: [email protected]
> Subject: [qmailtoaster] Re: Perl Bot
>
> On 04/11/2011 04:40 PM, Mike Canty wrote:
>> Eric,
>> Thanks for the response.
>>
>> The Anti-Virus I am using is removing the files, as they are detected, so
>> it's a bit hard to tell. They are actioned late at night, so we are not
>> looking then, however, something must be setting them there.
>>
>> There is one text file still in the "/tmp/" directory, that is infected
> and
>> this is owned by apache. So is this a Webmail item?
>>
>> -rw-r--r-- 1 apache apache 28026 Apr 9 22:18 dude.txt
>
> That's what it appears to be.
>
> I'm a little surprised that clamav did not find this one. Do you have
> that turned off for some reason, or did it miss this? It's possible that
> if you got one in a mailbox that sneaked in before clamav had a
> signature for it, that every time it's opened by the user using webmail
> that it's putting the file back in the /tmp directory.
>
> The filename dude.txt is a little suspicious to me though. I would
> expect SM to use some sort of unique name for an attachment, if that's
> what it is.
>
> I'm thinking now that it's perhaps something not even coming from email.
> Could it be coming from apache via some other route? Do you have apache
> running anything besides the stock QMT stuff? Roundcube perhaps?
>
>> Trying to "cat" the file brought back information from our AV
>>
>> cat: dude.txt: Operation not permitted
>> [root@msrverpd tmp]#
>> ********************** Sophos Anti-Virus Alert ***********************
>> Virus "Mal/PerlBot-A" detected in file
>> "/tmp/dude.txt".
>>
>> Access to the file has been denied
>> Please contact your IT department.
>> **********************************************************************
>>
>> At least we know we are protected.
>
> That's good.
>
>> As for the AV on the mailboxes, are you talking about the server side or
> the
>> client side? We run Sophos AV on all clients.
>
> Server side. /home/vpopmail/domains/*/*/Maildir/* files, recursively.
>
----------------------------------------------------------------------------
-----
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
----------------------------------------------------------------------------
-----
Please visit qmailtoaster.com for the latest news, updates, and
packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail:
[email protected]
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
