Generally speaking, malware that sends email creates its own mail service right on the local workstation.
It's rather unusual that you would see virus spam piling up in your GWIA from a local client. If this is in fact what's happening, then you could be looking at a targeted attack rather than a random infection.
Go to the send folder, pick a few of the outgoing spams and open them up with Notepad or another text editor. Examine the message headers. If the message is coming from an internal client, you should be able to identify the logged in user. If not, the headers should provide an IP address that will help you track it down. There are often spurrious fake headers added to spam to make it harder to track, but the real headers will be in there somewhere.
Don't assume it must be a local workstation sending the mail. Another possibility is that, despite your settings, the GWIA is actually acting as an open relay. View the GWIA.CFG file in your system folder and verify that relaying is off. Also make sure the GWIA has been restarted
You can use any of several relay checking utilities available on the web to test your server and see if it is acting as a relay. Here are a couple.
http://www.abuse.net/relay
http://www.dnsgoodies.com/
Main Topics
Browse All Topics
by: Admin3kPosted on 2009-10-17 at 03:56:58ID: 25595577
Kogin to a machine on he same network segment / switch of your mail server, run a protocol analyzer like Wireshark
Capture traffic from the Network interface, filter down by Destination Port 25, try to accomplish this in a time you know the mails are being sent, you should notice an IP address that is communicating more than it should with your mail server.