十八、测试使用反病毒及反垃圾模块

1、病毒邮件发送测试

登录extmail，发送带有病毒附件的邮件(病毒样本文件后文附有)，查看发送情况:

# tail  -3  /var/log/clamav/clamd.log

[Copy to clipboard] [ - ]
CODE:
Reading databases from /usr/local/clamav/share
Database correctly reloaded (148100 signatures)
/var/amavis/tmp/amavis-20070918T225935-28502/parts/p002: Trojan.Downloader.Delf-747 FOUN

#tail -15 /var/log/maillog

[Copy to clipboard] [ - ]
CODE:
Sep 18 23:36:40 mail postfix/pickup[28925]: 8C1681A609: uid=1001 from=<marion@test.com>
Sep 18 23:36:40 mail postfix/cleanup[29002]: 8C1681A609: message-id=<20070918153640.8C1681A609@mail.benet.org>
Sep 18 23:36:40 mail postfix/qmgr[28924]: 8C1681A609: from=<marion@test.com>, size=83658, nrcpt=1 (queue active)
Sep 18 23:36:43 mail clamd[28473]: /var/amavis/tmp/amavis-20070918T225935-28502/parts/p002: Trojan.Downloader.Delf-747 FOUND
Sep 18 23:36:44 mail postfix/smtpd[29011]: connect from mail[127.0.0.1]
Sep 18 23:36:44 mail postfix/smtpd[29011]: CDF9B1A602: client=mail[127.0.0.1]
Sep 18 23:36:44 mail postfix/cleanup[29002]: CDF9B1A602: message-id=<VA7mnx1DHavOWC@mail.benet.org>
Sep 18 23:36:44 mail postfix/smtpd[29011]: disconnect from mail[127.0.0.1]
Sep 18 23:36:44 mail postfix/qmgr[28924]: CDF9B1A602: from=<postmaster@benet.org>, size=2230, nrcpt=1 (queue active)
Sep 18 23:36:44 mail amavis[28502]: (28502-05) Blocked INFECTED (Trojan.Downloader.Delf-747), <marion@test.com> -> <marion@test.com>, quarantine: virus-7mnx1DHavOWC, Message-ID: <20070918153640.8C1681A609@mail.benet.org>, mail_id: 7mnx1DHavOWC, Hits: -, size: 83658, 4203 ms
Sep 18 23:36:45 mail postfix/smtp[29006]: 8C1681A609: to=<marion@test.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=4.7, delays=0.42/0.05/0.12/4.1, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, id=28502-05 - VIRUS: Trojan.Downloader.Delf-747)
Sep 18 23:36:45 mail postfix/qmgr[28924]: 8C1681A609: removed
Sep 18 23:36:45 mail postfix/local[29014]: CDF9B1A602: to=<root@benet.org>, orig_to=<postmaster@benet.org>, relay=local, delay=0.28, delays=0.12/0.09/0/0.07, dsn=2.0.0, status=sent (delivered to mailbox)
Sep 18 23:36:45 mail postfix/qmgr[28924]: CDF9B1A602: removed

说明：此附件中带有特洛伊病毒，请不要作为危害别人之用，而对于您的操作不慎而给您带来的后果，作者不负任何责任；病毒样本如下：

2、垃圾邮件测试

登录extmail，新建一封邮件，拷贝以下内容作为邮件正文，并查看发送情况:

This is the GTUBE, the
        Generic
        Test for
        Unsolicited
        Bulk
        Email

If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting incoming
spam. You can send yourself a test mail containing the following string of
characters (in upper case and with no white spaces and line breaks):

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

查看发送结果：
#tail -15 /var/log/maillog

[Copy to clipboard] [ - ]
CODE:
Sep 19 00:04:07 mail spamd[29060]: logger: removing stderr method
Sep 19 00:04:11 mail spamd[29062]: rules: meta test FM_DDDD_TIMES_2 has dependency 'FH_HOST_EQ_D_D_D_D' with a zero score
Sep 19 00:04:11 mail spamd[29062]: rules: meta test FM_SEX_HOSTDDDD has dependency 'FH_HOST_EQ_D_D_D_D' with a zero score
Sep 19 00:04:11 mail spamd[29062]: rules: meta test HS_PHARMA_1 has dependency 'HS_SUBJ_ONLINE_PHARMACEUTICAL' with a zero score
Sep 19 00:04:11 mail spamd[29062]: spamd: server started on port 783/tcp (running version 3.2.3)
Sep 19 00:04:12 mail spamd[29062]: spamd: server pid: 29062
Sep 19 00:04:12 mail spamd[29062]: spamd: server successfully spawned child process, pid 29064
Sep 19 00:04:12 mail spamd[29062]: spamd: server successfully spawned child process, pid 29065
Sep 19 00:04:12 mail spamd[29062]: prefork: child states: II
Sep 19 00:06:44 mail postfix/pickup[28925]: E37651A60E: uid=1001 from=<marion@test.com>
Sep 19 00:06:44 mail postfix/cleanup[29073]: E37651A60E: message-id=<20070918160643.E37651A60E@mail.benet.org>
Sep 19 00:06:45 mail postfix/qmgr[28924]: E37651A60E: from=<marion@test.com>, size=1041, nrcpt=1 (queue active)
Sep 19 00:07:01 mail amavis[28502]: (28502-06) Blocked SPAM, <marion@test.com> -> <marion@test.com>, quarantine: spam-7ui+Zpn7-M00.gz, Message-ID: <20070918160643.E37651A60E@mail.benet.org>, mail_id: 7ui+Zpn7-M00, Hits: 1004.576, size: 1040, 12805 ms
Sep 19 00:07:01 mail postfix/smtp[29079]: E37651A60E: to=<marion@test.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=18, delays=1.8/1.5/4.9/9.9, dsn=2.5.0, status=sent (250 2.5.0 Ok, id=28502-06, DISCARD(bounce.suppressed))
Sep 19 00:07:01 mail postfix/qmgr[28924]: E37651A60E: removed
最后编辑： selboo 编辑于2010/07/23 20:34