MyDoom in mail queue


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting MyDoom in mail queue
# 1  
Old 02-09-2004
MyDoom in mail queue

Is there someone out there that has a script for cleaning up the mail queue after viruses such as MyDoom?
# 2  
Old 02-09-2004
what do you mean clean up the mail queue?
# 3  
Old 02-09-2004
In the mail queue (mailq && /var/spool/mqueue) we have a bunch of MyDoom virus emails waiting to be delivered to domains and email addresses that does not exist.

I would like to remove them since they should not be sent because they are viruses.

I have a start of a script:
grep -f ./patterns.txt /var/spool/mqueue/dfi* | awk -F: '{print $1}' | tr -d '/var/spool/mqueue/dfi' | awk -F: '{print "rm -
f /var/spool/mqueue/qfi"$1" /var/spool/mqueue/dfi"$1}'>/home/pjohansson/mqueue/filtered/run_this
chmod +x ./run_this

With the accompaning file:
cat patterns.txt
filename="message.zip"
filename="body.zip"
filename="data.zip"
filename="text.scr"
filename="text.zip"
filename="data.pif"
filename="readme.zip"
filename="file.zip"
filename="readme.scr"

but I am getting
rm: lstat 'filename' cannot find file or something like this.
# 4  
Old 02-09-2004
The following line is messing with the file name so that it isn't correct anylonger.
tr -d '/var/spool/mqueue/dfi'

It takes "/var/spool/mqueue/dfi19KKak8007138" and returns "19KKk8007138". So somehow it removes the lower case a. What I want it to do is to remove the path up to and including the dfi in the filename.

Any ideas why it removes the a?
Any suggestions on what else to use? sed?
# 5  
Old 02-09-2004
Quote:
Originally posted by pmj1970
The following line is messing with the file name so that it isn't correct anylonger.
tr -d '/var/spool/mqueue/dfi'

It takes "/var/spool/mqueue/dfi19KKak8007138" and returns "19KKk8007138". So somehow it removes the lower case a. What I want it to do is to remove the path up to and including the dfi in the filename.
Not sure what the pattern is here ... do you have multiple files that start with dfi but are located in different directories?

The solution could be to use
Code:
... | sed 's=/var/spool/mqueue/dfi==' | ...

but usually you want the answer to be able to fit a variety of different file name patterns, and not just ones that begin with dfi and are located in /var/spool/mqueue...
# 6  
Old 02-09-2004
Thanks!

sed worked for me.
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Client was not authenticated to send anonymous mail during MAIL FROM (in reply to MAIL FROM comm

I am having trouble getting mail to work on a red hat server. At first I was getting this message. Diagnostic-Code: X-Postfix; delivery temporarily suspended: connect to :25: Connection refused Then added the port to my firewall. Then I temporarily turned off selinux. I then copied this file... (1 Reply)
Discussion started by: cokedude
1 Replies

2. Shell Programming and Scripting

Check mail queue

We use Redhat server , we always use mailq to check any pending mail in mailq , when run the command mailq , it shows all existing pending mail would advise how to write a script to show the pending mails which are older than 24 hours , ( if possible , then send this pending mail info to... (9 Replies)
Discussion started by: ust3
9 Replies

3. Shell Programming and Scripting

Check pending mail in mail queue

I know the command mailq can check the pending mail in mqueue , and also have another command to check POSIX mail queue in server , now I will regularly check the mqueue manually , it is time consuming , would advise the script that could help to check the mail queue , and then send the details to... (3 Replies)
Discussion started by: ust3
3 Replies

4. UNIX for Dummies Questions & Answers

Mail Queue refilling

Hello I'm using Cent OS6 and a webmin interface I've had an issue where over 1 million emails were queued in the sendmail mail queue. I found a thread on here from 2002 explaining how to delete them all and it worked great. Thanks Perderabu unix-for-dummies-questions-and-answers /... (0 Replies)
Discussion started by: bullbreed
0 Replies

5. Shell Programming and Scripting

flush the mail queue

Hi Guys, My mail queue is showing a mail. I want to flush the queue. Can you let me know how to flush the mail queue. Regards, Magesh (12 Replies)
Discussion started by: mac4rfree
12 Replies

6. IP Networking

postfix - reinject mail to postfix from hold queue directory

hi all. Am using smtpd_recipient_restrictions & check_recipient_access in postfix. The hash file looks like this: emailaddress1 HOLD emailaddress2 HOLD The aim is to place email from these recipients in the hold directory,check them then reinject them back in postfix on some... (0 Replies)
Discussion started by: coolatt
0 Replies

7. UNIX for Advanced & Expert Users

mail is not sent, instead just coping into /var/spool/queue dir

Hi, I have some problems w/ the sendmail. I see that messages are queued in the /var/spool/mqueue and they are never sent to the recipients. This problem just suddenly started without any modifications in the current configuration. I already started and stop the sendmail and it did not help.... (3 Replies)
Discussion started by: ktanya
3 Replies

8. Shell Programming and Scripting

shell script needed for mail queue notification

Hi shell experts, I would like to have a shell script running in a redhat server for monitoring the mailqueue status. I have already installed the qmHandle and I am using it to get a status of the mail queue in daily basis. I am executing the qmhandle in the cron. Now I am planning to execute... (10 Replies)
Discussion started by: Nightman
10 Replies

9. UNIX for Dummies Questions & Answers

Clearing Mail Queue

Hello, I am trying to clear my mail queue with the following command: rm /var/spool/mqueue/* But when I do this I get this error: /bin/rm: Argument list too long. Can someone tell me what that error means and what I can do to correct it so I can clear my mail queue? Thanks (2 Replies)
Discussion started by: Chet
2 Replies
Login or Register to Ask a Question