Link to home
Start Free TrialLog in
Avatar of RAMCIT
RAMCIT

asked on

Help we are sending spam from somewhere inside our domain!

Hello Experts!
Earlier today, I found out we had been listed by SPAMCOP (http://spamcop.net/bl.shtml) as an originator of spam email, and also with PSBL (http://psbl.surriel.com). Can anyone please point me in the right direction as far as finding out a way to see if any of the PCs inside our domain are infected with some kind of spamware?

Thanks a lot!
ASKER CERTIFIED SOLUTION
Avatar of AdamRobinson
AdamRobinson
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of RAMCIT
RAMCIT

ASKER

Actually Im runing Exchange 5.5 on an NT enviromnent.
Avatar of RAMCIT
RAMCIT

ASKER

ll, according to http://www.dnsreport.com/ we reject releys.
Avatar of AdamRobinson
AdamRobinson
If you open the queues in your Exchange System Manager, do you see a lot of mails waiting to be sent?
Avatar of RAMCIT
RAMCIT

ASKER

more than usual yes
Avatar of AdamRobinson
AdamRobinson
Ok, I know DNS Report shows you reject relays, but try following the instructions in the link above and see if they go away. ;)
Avatar of RAMCIT
RAMCIT

ASKER

Well I cannot seem to get into the server via telnet, says:

Server allows NTLM authentication only
Avatar of Simon Earl
Simon Earl
Flag of United Kingdom of Great Britain and Northern Ireland image
OK....

What AV and AntiSpyware do you use ?

Also, if you are using cisco routers let me know as I've got some neat tricks for these.

Cheers
Si


Avatar of RAMCIT
RAMCIT

ASKER

Well on this server we have Trend Micro Scanmail for the exchange
No active antispyware.
Avatar of RAMCIT
RAMCIT

ASKER

oh and this T1 connection uses a Cisco 2600 router with a watchguard firebox firewall.
Avatar of Simon Earl
Simon Earl
Flag of United Kingdom of Great Britain and Northern Ireland image
Does your Cisco router have Netflow enabled ?

Thanks
Si
Avatar of RAMCIT
RAMCIT

ASKER

I have no idea
Avatar of Simon Earl
Simon Earl
Flag of United Kingdom of Great Britain and Northern Ireland image
OK,

OK, from a quick google, the 2600 routers do have Netflow on them.

Try this

Go here ---> http://www.manageengine.co.uk/

Download NetFlow Analyzer and install it....configure the router as per the instructions in the documentation to enable netflow packets and then leave it to run for an hour.

Go back in to NetFlow Analyzer and you will see a list of traffic broken down by type and then you see which machines are sending large amounts of SMTP traffic.

Let me know if you get stuck

Thanks
Si