How can I identify the source (a user's workstation) of a trojan horse virus that is sending spam. We have Groupwise 7.0 : Groupwise, spam, trojan horse

Experts Exchange

	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

How can I identify the source (a user's workstation) of a trojan horse virus that is sending spam. We have Groupwise 7.0

Asked by DWIvey in Novell Groupwise, Spam Assassin, HijackThis Software

Tags: Groupwise, spam, trojan horse

We're finding 10's of 000's of emails stuck in our groupwise GWIA's send folder. These emails are spam trying to be sent. We are trying to identify from which user or user's workstation these are being sent. Our mail server gets stuck and no legitimate emails get sent because the queue is clogged. We rename the send folder and create a new one which temporarily solves the problem. These emails are targeted to mostly overseas (Italy, Spain) recipients.

We have been blacklisted a few times.

I have log files but they don't tell me much. I've run virus/malware scans on all the workstations to no avail...
Port 25 is closed and smtp relaying is prohibited (in Console 1)
Anyone have any ideas as to how to stop this?

View the Solution FREE for 30 Days

20091021-EE-VQP-81 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. ZENandE...109,580
2. billmercer18,700
3. dabernathy11,500
4. ShineOn8,500
5. arixsin7,480
6. deroode6,300
7. steveoskh5,000
8. giovannicoa3,500
9. mplungjan2,500
9. tbsgadi2,500
9. Psychotec2,500
12. PsiCop2,050
13. RQuadling2,000
13. KOTiS2,000
13. BudDurland2,000
13. alextoft2,000
13. DaveHowe2,000
13. chigle2,000
13. solomona...2,000
13. demazter2,000
13. MikeMar102,000
13. jdera2,000
13. clayfox2,000
13. sl8rz2,000
13. Kelly_W2,000
13. tenaj-2072,000
13. Illusionist2,000
13. Shekhar2...2,000

1. PsiCop329,724
2. ShineOn287,801
3. ZENandE...127,580
4. billmercer113,281
5. steveoskh32,430
6. floyd9925,789
7. BigBadFle...18,849
8. waybadm...17,501
9. blcarter1416,000
10. dabernathy11,500
11. alextoft10,411
12. Ghost969,900
13. dotENG8,560
14. MarkMich...7,960
15. ranhell7,890
16. BudDurland7,500
17. arixsin7,480
18. deroode6,300
19. mattee766,000
20. dfke5,900
21. giovannicoa4,700
22. puppydog...4,000
22. hbustan4,000
22. bptrimm4,000
25. mcsween3,460