Explosion de connexions sans savoir pourquoi

[Valhala]

Bonjour,

j'ai un petit problème, mon hébergeur a coupé mon compte à cause de connexion excessive sur mon site. Hier il m'a autorisé l'accès pour que je jette un coup d'oeil au logs de apache, j'y trouve énormément de referrerbots mais tout en étant normal par rapport aux autres mois (concernant les pages vues).

Même pas 5 minutes mainte,ant, mon compte à nouveau été bloqué pour cause de connexion excessive plantant apache, j'ai même eu droit aux graphique qui sont plutôt impressionnant par rapport aux peu de pages vues (5000 par jours je crois).

En même temps hier j'ai reçu quelques mails du genre

BANNED CONTENTS ALERT

Our content checker found

    banned name: .exe

in email presumably from you (<info_AT_valhala.be>), to the following recipients:

-> dan_AT_dvdsforabuck.com

-> help_AT_dvdsforabuck.com

-> IBELKPOEOIMIABNMHOGKGEPMCHAA.dan_AT_dvdsforabuck.com

Delivery of the email was stopped!

The message has been blocked because it contains a component (as a MIME part or nested within) with declared name or MIME type or contents type violating our access policy.

To transfer contents that may be considered risky or unwanted by site policies, or simply too large for mailing, please consider publishing your content on the web, and only sending an URL of the document to the recipient.

Depending on the recipient and sender site policies, with a little effort it might still be possible to send any contents (including

viruses) using one of the following methods:

- encrypted using pgp, gpg or other encryption methods;

- wrapped in a password-protected or scrambled container or archive

  (e.g.: zip -e, arj -g, arc g, rar -p, or other methods)

Note that if the contents is not intended to be secret, the encryption key or password may be included in the same message for recipient's convenience.

We are sorry for inconvenience if the contents was not malicious.

The purpose of these restrictions is to cut the most common propagation methods used by viruses and other malware. These often exploit automatic mechanisms and security holes in certain mail readers (Microsoft mail readers and browsers are a common and easy target). By requiring an explicit and decisive action from the recipient to decode mail, the dangers of automatic malware propagation is largely reduced.

For your reference, here are headers from your email:

------------------------- BEGIN HEADERS -----------------------------

Return-Path: <info_AT_valhala.be>

Received: from axrcxsafw.be (c-67-163-171-160.hsd1.ct.comcast.net [67.163.171.160])

by www.dvdsforabuck.com (Postfix) with SMTP

id 9A068240C9; Sat, 10 Dec 2005 14:36:25 -0800 (PST)

From: info_AT_valhala.be

To: help_AT_dvdsforabuck.com

Date: Sat, 10 Dec 2005 21:34:27 UTC

Subject: Mail_delivery_failed

Importance: Normal

X-Priority: 3 (Normal)

Message-ID: <3fc17da80a2a0dd3108_AT_dvdsforabuck.com>

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="==2349bcf1a1f3147dcf536"

Content-Transfer-Encoding: 7bit

-------------------------- END HEADERS ------------------------------

Alors que seul contact_AT_valhala.be est reglé par phpmyadmin et joue de rôle de "fetch all". Je me demande si le serveur est pas infecté, qu'en pensez vous ?

Merci de votre aide

P.S: Vu mon compte bloqué, j'ai plus accès à phpmyadmin donc aucun logs ou stats à ajouter dans le sujet.