OSX server sending out "spam?"

Question

I'm a student at a technical college and am working part time for the Mac admin guy. We have about 400 macs in the art dept. Yesterday our sysadmin said our server was sending out spam.
This server is not running mail but here are a couple of excerpts from our mail.log:
Aug 7 06:40:38 servername postfix/pickup[14340]: 547BE6B7AB8: uid=1032 from=<image>
Aug 7 06:40:38 servername postfix/cleanup[14552]: 547BE6B7AB8: message-id=<20070807114037.547BE6B7AB8@servername>
Aug 7 06:40:38 servername postfix/qmgr[14556]: 547BE6B7AB8: from=<[email protected]>, size=1675, nrcpt=1 (queue active)
Aug 7 06:40:45 servername postfix/smtp[14557]: 547BE6B7AB8: host g.mx.mail.yahoo.com[206.190.53.191] said: 421 Message temporarily deferred - 4.16.51. Please refer to http://help.yahoo.com/help/us/mail/defer/defer-06.html (in reply to end of DATA command)
Aug 7 06:40:45 servername postfix/smtp[14557]: 547BE6B7AB8: to=<[email protected]>, relay=d.mx.mail.yahoo.com[216.39.53.2], delay=8, status=sent (250 ok dirdel)
Aug 7 06:40:45 servername postfix/qmgr[14556]: 547BE6B7AB8: removed
Aug 7 06:44:23 servername postfix/pickup[14340]: C0F876B7AC2: uid=1032 from=<image>
Aug 7 06:44:23 servername postfix/cleanup[14600]: C0F876B7AC2:message-id=<20070807114423.C0F876B7AC2@servername>
Aug 7 06:44:23 servername postfix/qmgr[14556]: C0F876B7AC2: from=<[email protected]>, size=1626, nrcpt=1 (queue active)
Aug 7 06:44:23 servername postfix/pickup[14340]: C8D2C6B7AC4: uid=1032 from=<image>
Aug 7 06:44:23 servername postfix/cleanup[14600]: C8D2C6B7AC4: message-id=<20070807114423.C8D2C6B7AC4@servername>
Aug 7 06:44:23 servername postfix/pickup[14340]: CEC0B6B7AC6: uid=1032 from=<image>
Aug 7 06:44:23 servername postfix/cleanup[14600]: CEC0B6B7AC6:message-id=<20070807114423.CEC0B6B7AC6@servername>
Aug 7 06:44:23 servername postfix/qmgr[14556]: C0F876B7AC2: to=<[email protected]>, relay=none, delay=0, status=bounced (invalid recipient syntax: "[email protected]")
Aug 7 06:44:23 servername postfix/qmgr[14556]: C8D2C6B7AC4: from=<[email protected]>, size=1624, nrcpt=1 (queue active)
Aug 7 06:44:23 servername postfix/cleanup[14600]: DA8706B7AC9: message-id=<20070807114423.DA8706B7AC9@servername>
and
Aug 8 10:11:57 servername postfix/qmgr2338: DADE98C3EB9: to=<[email protected]>, relay=none, delay=14040, status=deferred (delivery temporarily suspended: host ironport1.chron.comhttp://130.80.29.15 refused to talk to me: 554 ironport1.chron.com)
Aug 8 10:11:57 servername postfix/qmgr2338: E89098C1C03: to=<[email protected]>, relay=none, delay=14082, status=deferred (delivery temporarily suspended: host ironport1.chron.comhttp://130.80.29.15 refused to talk to me: 554 ironport1.chron.com)
Aug 8 10:11:57 servername postfix/qmgr2338: EEE378C2CB3: to=<[email protected]>, relay=none, delay=14231, status=deferred (delivery temporarily suspended: host ironport1.chron.comhttp://130.80.29.15 refused to talk to me: 554 ironport1.chron.com)
Aug 8 10:11:57 servername postfix/smtp13748: 2C26E8979B3: to=<[email protected]>, relay=mx-nj-2.pobox.comhttp://208.210.124.72, delay=39263, status=deferred (host mx-nj-2.pobox.comhttp://208.210.124.72 said: 450 <[email protected]>: Sender address rejected: Domain not found (in reply to RCPT TO command))
Aug 8 10:11:57 servername postfix/smtp13748: 2BC7D8C61AC: to=<[email protected]>, relay=mail.cyberscope.nethttp://64.95.223.22, delay=13796, status=deferred (host mail.cyberscope.nethttp://64.95.223.22 said: 451 unable to accept non-FQDN HELO (#4.3.0) (in reply to MAIL FROM command))
Aug 8 10:11:57 servername postfix/smtp13748: connect to cluster9.us.messagelabs.comhttp://216.82.253.115: Connection refused (port 25)
Aug 8 10:11:57 servername postfix/smtp13748: connect to cluster9.us.messagelabs.comhttp://216.82.250.99: Connection refused (port 25)
Aug 8 10:11:57 servername postfix/smtp13748: connect to cluster9.us.messagelabs.comhttp://216.82.250.115: Connection refused (port 25)
We set up VirusBarrier and scanned the server. This is a copy of our console.log:
Mac OS X Version 10.4.9 (Build 8P135)
2007-08-08 10:20:50 -0500
2007-08-08 10:20:55.538 SystemUIServer486 lang is:en
Aug 8 10:22:39 servername authexec: executing /Library/Intego/netupdated.bundle/Contents/Resources/NetUpdate Installer.app/Contents/MacOS/NetUpdate Installer
Aug 8 10:49:43 servername servermgrd: servermgr_dns: no name available via DNS for our IP addy
Aug 8 10:49:43 servername servermgrd: servermgr_dns: no reverse DNS entry for server, various services may not function properly
virus OSX.Botch.Gen found in file: /Volumes/Startup OS X/private/var/tmp/ /mech/kupdateb
virus OSX.Botch.Gen found in file: /Volumes/Startup OS X/private/var/tmp/ /mech/src/mech
virus OSX.PsyBot.232 found in file: /Volumes/Startup OS X/private/var/tmp/psybnc/psybnc
Aug 8 11:19:43 servername servermgrd: servermgr_dns: no name available via DNS for our IP addy
Aug 8 11:19:43 servername servermgrd: servermgr_dns: no reverse DNS entry for server, various services may not function properly
virus OSX.Botch.Gen found in file: /Volumes/Startup OS X/private/var/tmp/ /mech/kupdateb
virus OSX.Botch.Gen found in file: /Volumes/Startup OS X/private/var/tmp/ /mech/src/mech
<CFURL 0x62bd440 0xa07bc150>{type = 15, string = file://localhost/Library/Contextual%20Menu%20Items/PortfolioCM.plugin/, base = (null)}
Finder tool: request to change uid to 501 gid to -1 for /private/tmp/vbx4smail_6v97Qz
virus Resource structure error found in file: /Volumes/Image Backup Drive/Old Labs Images/345 iMacs/Macintosh HD/System Folder/Help/HP LaserJet Printer Help/Help/Graphics/printer_word.JPG
Aug 8 11:49:43 servername servermgrd: servermgr_dns: no name available via DNS for our IP addy
Aug 8 11:49:43 servername servermgrd: servermgr_dns: no reverse DNS entry for server, various services may not function properly
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/animations/flahsbathtub/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/animations/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/contact/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/illustrations/photomontage/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/illustrations/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/images/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/greennotes/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/madisonframes/ARTWORK/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/makingcrepes/crepesjpeg/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/WS_FTP.LOG
virus Resource structure error found in file: /Volumes/Image Backup Drive/.Trashes/501/printer_word.JPG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-08-37.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-08-41.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-08-45.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-09-01.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-09-15.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-09-22.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/greennotes/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/madisonframes/ARTWORK/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/makingcrepes/crepesjpeg/WS_FTP.LOG
Aug 8 12:19:43 servername servermgrd: servermgr_dns: no name available via DNS for our IP addy
Aug 8 12:19:43 servername servermgrd: servermgr_dns: no reverse DNS entry for server, various services may not function properly
<CFURL 0x5004b0 0xa07bc150>{type = 15, string = file://localhost/Library/Contextual%20Menu%20Items/PortfolioCM.plugin/, base = (null)}
<CFURL 0x3a5c30 0xa07bc150>{type = 15, string = file://localhost/Library/Contextual%20Menu%20Items/PortfolioCM.plugin/, base = (null)}
Aug 8 12:26:21 servername ARDAgent 320: no multicast
virus Resource structure error found in file: /Volumes/Image Backup Drive/.Trashes/501/printer_word.JPG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-08-37.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-08-41.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-08-45.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-09-01.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-09-15.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP 12-09-22.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/.Trashes/501/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/greennotes/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/madisonframes/ARTWORK/WS_FTP.LOG
virus Resource error : data offset > Res. map offset found in file: /Volumes/Image Backup Drive/Old Labs Images/Portfolio/Mac HD/Desktop Folder/Portfolios/SMVandre/websites/makingcrepes/crepesjpeg/WS_FTP.LOG
Aug 8 12:29:49 servername cyrus-quota1693: DBERROR: reading /var/imap/db/skipstamp, assuming the worst: No such file or directory
at which point we rebooted.
So we have changed all are passwords, are reimaging everything and had the sysadmin block all outgoing messages on port 25. In addition we have sent copies of the logs to Intego.
That all happened Wednesday. Unfortunately this mornings system log had:
Aug 10 02:58:45 servername VirusBarrierServer[461]: File infected: /private/var/tmp/.blan/.bot/rom by OSX.Botch.302
Aug 10 02:59:08 servername VirusBarrierServer[461]: File infected: /private/var/tmp/.ou/.bot/ru by OSX.Botch.302
Aug 10 02:59:28 servername VirusBarrierServer[461]: File infected: /private/var/tmp/.tmp/ /.bot/darwin by OSX.Botch.302
Aug 10 02:59:49 servername VirusBarrierServer[461]: File infected: /private/var/tmp/.tmp/.bot/crond by OSX.Botch.302
I know that this is an incredibly vague question but what would you suggest I do now?
Is there a way to find out where these "virus'" came from?
It is not impossible they were put on by a student as we recently found out that a number of the help desk students had the Mac admin password. I've looked at the install logs and the only things I see are the Apple software updates and apps we installed ourselves.
I realize that no mac virus' or worms have been found in the wild so it is unclear what VirusBarrier is reporting but it seems that ummm "something" is hiding somewhere and "infecting" these files and I'd like to get rid of it.
thanks for your time and help )
lex
Message was edited by: LexaniG

Answer 1

What appears to be happening is that something is installing the IRC bot EnergyMech in hidden files on our server.
Aug 10 02:59:28 servername VirusBarrierServer461: File infected: /private/var/tmp/.tmp/ /.bot/darwin by OSX.Botch.302
When I checked the contents of the .tmp file with ls -Rla I found:
.tmp/ :
otal 1320
drwxr-xr-x 4 image wheel 136 Jun 24 19:44 .
drwxr-xr-x 5 image wheel 170 Jun 24 19:44 ..
drwx------ 16 image wheel 544 Jun 24 20:00 .bot
-rw-r--r-- 1 image wheel 675159 Jun 24 19:44 sclavi.tar
.tmp/ /.bot:
total 2144
drwx------ 16 image wheel 544 Jun 24 20:00 .
drwxr-xr-x 4 image wheel 136 Jun 24 19:44 ..
-rw-r--r-- 1 image wheel 351 Jun 28 10:00 1
-rw-r--r-- 1 image wheel 351 Jun 28 10:00 2
-rw-r--r-- 1 image wheel 351 Jun 28 07:00 3
-rwx------ 1 image wheel 412095 Jul 8 2005 bash
-rwxr-xr-x 1 image wheel 0 Aug 10 02:59 darwin
-rw-r--r-- 1 image wheel 354306 Oct 19 2005 freebsd
-rw------- 1 image wheel 22465 Jun 13 2001 mech.help
-rw-r--r-- 1 image wheel 1015 Jun 28 10:00 mech.levels
-rw------- 1 image wheel 6 Jun 24 19:44 mech.pid
-rw-r--r-- 1 image wheel 1457 Jun 28 10:00 mech.session
-rw-r--r-- 1 image wheel 5365 May 4 11:34 mech.set
-rwxr-xr-x 1 image wheel 178908 Sep 20 2005 pico
-rw-r--r-- 1 image wheel 87673 Jun 27 2006 pico.tgz
drwx------ 10 image wheel 340 May 27 2004 randfiles
After chmoding the files so that they were non-excecutable mech.set contained this:
# Zei`s EnergyMech configuration file
# v2.9.3 - CristofoR
##### Linking #####
#ENTITY emech
#LINKPASS abc123
#LINKPORT 49152
#LINK hismech a1b2c3 mech.host.net 49152
#LINK hermech abcdefg 0 0
AUTOLINK
##### Server List ####
SERVER LosAngeles.CA.US.Undernet.org 6665
SERVER LosAngeles.CA.US.Undernet.org 6668
SERVER LosAngeles.CA.US.Undernet.org 7000
Unfortunately as a student I theoretically don't have access to the server again until Monday... But I'll go in tomorrow and try and find someone to turn it off. heh (I suppose one way to find out who's on call is to shut it down and see who shows up...) In any case I'll try and delete any of these files I can find.
My boss is out of town and I'm over my head here so any and all suggestions will be gratefully received.
thanks
lex
Message was edited by: LexaniG
Message was edited by: LexaniG