Microsoft Mail Internet Headers Version 2.0
Received: from domain ([118.69.34.3] RDNS failed) by domain with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 10 May 2011 10:34:02 +0700
From: "Mail Administrator" <MAILER-DAEMON@domain>
To: user2@domain
Subject: Returned mail: Data format error
Date: Tue, 10 May 2011 10:27:45 +0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0008_9396C5B9.E65A9911"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Return-Path: MAILER-DAEMON@domain
Message-ID: <SRV2T6sQHmuX7b0TydU0000001c@domain>
X-OriginalArrivalTime: 10 May 2011 03:34:02.0639 (UTC) FILETIME=[1B4DB1F0:01CC0EC3]
------=_NextPart_000_0008_9396C5B9.E65A9911
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit
------=_NextPart_000_0008_9396C5B9.E65A9911
Content-Type: application/octet-stream;
name="user2@domain.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="user2@domain.zip"
------=_NextPart_000_0008_9396C5B9.E65A9911--

Dear user user1@domain,
We have detected that your email account was used to send a huge amount of junk email during this week.
Most likely your computer had been infected by a recent virus and now contains a trojaned proxy server.
Please follow instructions in order to keep your computer safe.
Best regards,
The domain support team.

--== Initialization Complete ==--
,,_ -*> Snort! <*-
o" )~ Version 2.9.0.1 GRE (Build 82)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
Copyright (C) 1998-2010 Sourcefire, Inc., et al.
Using libpcap version 1.1.1
Using PCRE version: 6.6 06-Feb-2006
Using ZLIB version: 1.2.3
Rules Engine: SF_SNORT_DETECTION_ENGINE Version 1.12 <Build 18>
Preprocessor Object: SF_DNS Version 1.1 <Build 4>
Preprocessor Object: SF_FTPTELNET Version 1.2 <Build 13>
Preprocessor Object: SF_DCERPC2 Version 1.0 <Build 3>
Preprocessor Object: SF_SDF Version 1.1 <Build 1>
Preprocessor Object: SF_Dynamic_Example_Preprocessor Version 1.0 <Build 1>
Preprocessor Object: SF_SMTP Version 1.1 <Build 9>
Preprocessor Object: SF_SSH Version 1.1 <Build 3>
Preprocessor Object: SF_SSLPP Version 1.1 <Build 4>
Commencing packet processing (pid=7218)

-rw-r--r-- 1 root root 18559 Nov 18 17:10 /etc/snort/snort.conf

Log mysql
echo "SELECTecho "SELECT hostname FROM snort.sensor;" | mysql -u snort -p
>

11/18-18:18:21.455781 [**] [1:408:5] ICMP Echo Reply [**] [Classification: Misc activity] [Priority: 3] {ICMP} 192.168.99.79 -> 192.168.99.207
11/18-18:18:22.455715 [**] [1:382:7] ICMP PING Windows [**] [Classification: Misc activity] [Priority: 3] {ICMP} 192.168.99.207 -> 192.168.99.79

This is an SMTP protocol log for virtual server ID 1, connection #158. The client at "41.201.108.176"
sent a "rcpt" command, and the SMTP server responded with "550 5.7.1 Unable to relay for
<a href="mailto:yuking.chiu@msa.hinet.net">yuking.chiu@msa.hinet.net</a> ". The full command sent was "rcpt TO: <yuking.chiu@msa.hinet.net>". This will
probably cause the connection to fail.
For more information, click http://www.microsoft.com/contentwwwect.asp.

2009-5-24 13:0:36 GMT [color=red]218.160.245.36 218-160-245-36.dynamic.hinet.net[/color]
- NEWSRV 192.168.10.2 a123999@ms33.hinet.net 1019
ETTNHBVCUVMOWVJNYSWKW@umail.hinet.net 1 0 2614 32 2009-5-24 13:0:25 GMT 0
Version: 6.0.3790.3959 - L/C}BץӽСEHΪʮƶUڡEHΪӽСEHΪBܲ{E whct@yahoo.de -
2009-5-24 13:0:36 GMT 218.160.245.36 218-160-245-36.dynamic.hinet.net - NEWSRV
192.168.10.2 a123a@ms33.hinet.net 1019 ETTNHBVCUVMOWVJNYSWKW@umail.hinet.net 1
0 2614 32 2009-5-24 13:0:25 GMT 0 Version: 6.0.3790.3959 -
L/C}BץӽСEHΪʮƶUڡEHΪӽСEHΪBܲ{E whct@yahoo.de -
2009-5-24 13:0:36 GMT 218.160.245.36 218-160-245-36.dynamic.hinet.net - NEWSRV
192.168.10.2 a1239813@ms24.hinet.net 1019 ETTNHBVCUVMOWVJNYSWKW@umail.hinet.net 1
0 2614 32 2009-5-24 13:0:25 GMT 0 Version: 6.0.3790.3959 -
L/C}BץӽСEHΪʮƶUڡEHΪӽСEHΪBܲ{E whct@yahoo.de -

he message with ID <FRPNTYBIWYOKAKMHNMKAUQXYE@ms81.hinet.net>, P1 From , Subject
¢e¢e³Q¶Å°ÈÀ£±o³Ý¤£¹L®ð¶Ü¡HÅý§Ú§U§A¤@Áu¤§¤O¢e¢emating ritual, from remote host "NEWSRV" was
Rejected/Deleted by Intelligent Message Filter. This is an informational event and does not indicate an error.
For more information, click http://www.microsoft.com/contentwwwect.asp.

2009-5-24 17:23:13 GMT [color=red]114.45.59.5[/color] 220.231.x.x - NEWSRV
192.168.10.2 x73427@yahoo.com.tw 1041 QQPZUWFOPMEQWFSVLGJPWO@yahoo.ca 3 0 3570
15 2009-5-24 17:23:9 GMT 0 Version: 6.0.3790.3959 - mmu[vN~A~u}IuutvXMufAe§B~a
̹bEImmover pvyqgaipxu@yahoo.ca -
2009-5-24 17:23:13 GMT 114.45.59.5 220.231.x.x - NEWSRV 192.168.10.2
<a href="mailto:wercyu@yahoo.com.tw">wercyu@yahoo.com.tw</a> 1041 QQPZUWFOPMEQWFSVLGJPWO@yahoo.ca 3 0 3570 15 2009-5-24
17:23:9 GMT 0 Version: 6.0.3790.3959 - mmu[vN~A~u}IuutvXMufAe§B~a ̹bEImmover
<a href="mailto:pvyqgaipxu@yahoo.ca">pvyqgaipxu@yahoo.ca</a> -
2009-5-24 17:23:13 GMT 114.45.59.5 220.231.x.x - NEWSRV 192.168.10.2
<a href="mailto:zq6@yahoo.com.tw">zq6@yahoo.com.tw</a> 1041 QQPZUWFOPMEQWFSVLGJPWO@yahoo.ca 3 0 3570 15 2009-5-24
17:23:9 GMT 0 Version: 6.0.3790.3959 - mmu[vN~A~u}IuutvXMufAe§B~a ̹bEImmover
<a href="mailto:pvyqgaipxu@yahoo.ca">pvyqgaipxu@yahoo.ca</a> -
2