Solved

Virus Sending out Spam

Posted on 2010-09-21
7
1,025 Views
Last Modified: 2013-11-30
I've got a client that may have a virus on one of their PC's sending out Spam. They have an off-site Spam filtering service that generates reports and shows Spam outgoing every night from about 11:00 PM to 8:00 AM. All their log shows is it coming from their Outside interface not specifically which PC. It does block the outgoing Spam but we're concerned it may be a virus. I've run their Trend Antivirus and Malwarebytes scans on all PC's and didn't find anything.

I had this same problem with another client but they had a Watch Guard Firewall that had a realttime log you could watch and refresh and I just watched it for a  few minutes and saw traffic on port 25 from a specific IP address that wasn't their mail server and was able to find the PC that way.

This client doesn't have that. I waswondering if there is some simple program out there I could install that would monitor their network for SMTP traffic and generate some sort of log. I've looked at programs like PRTG but I don't have 3 weeks to learn how to interepret the data it appears to generate. I just want to isolate which PC is sending out email traffic in the middle of the night. Is there anything like that available?

Thanks
0
Comment
Question by:Axis52401
  • 3
  • 2
  • 2
7 Comments
 
LVL 4

Expert Comment

by:HunterPine
ID: 33726771
Easiest way without spending a boatload of money would be to introduce a hub (not a switch, unless you have a manageable switch that does port mirroring) in between the network switch and internet router.

Hubs broadcast all traffic to all connected ports, so you can plug in any computer and run wireshark (free from www.wireshark.org) to sniff packets. It'll be pretty easy to narrow down your port 25 traffic from there.
0
 
LVL 2

Author Comment

by:Axis52401
ID: 33726872
I don't see getting a hub as an option here, I'm not physically onsite and lm doing this remotely and I'd rather not have them putting in networking equip over the phone.
0
 
LVL 4

Expert Comment

by:HunterPine
ID: 33727003
Without either a hub or a mirror port, there's no way to monitor the traffic. Switches don't broadcast unicast traffic to all machines on the network, so you'll never get a full view of traffic without the right hardware.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 29

Expert Comment

by:Sudeep Sharma
ID: 33728008
DO you have exchange server and firewall in place?

Does all the spam messages are routing from Exchange?

I mean does the infected PC sending email to Exchange and Exchange routing them to Internet?

Sudeep
0
 
LVL 2

Author Comment

by:Axis52401
ID: 33728220
SS,

   The only reason I know about it is that the offsite SPAM filter they use sends out a report each day with what it blocked and we keep getting reports that Spam starts to get sent out about 11PM and stops about 8AM. They do use Exchange but I can't tell if it's routing through the server or going directly out from one of the workstations (I have seen both in the past)
    I'm trying to find a way of narrowing down which PC or server it may be coming from.
0
 
LVL 2

Author Comment

by:Axis52401
ID: 33728233
Oh and their only 'firewall' is a DSL modem with limited firewall abilities.
0
 
LVL 29

Accepted Solution

by:
Sudeep Sharma earned 500 total points
ID: 33728368
And what Anti-Virus solution they are using?

Is logging enabled on Exchange server?

You could check the logs if emails are being send out from exchange, that would include the IP address of the host machine (system sending out spam)

Or if their SPAM Filter could send the details report of the emails which are sent, if you could get the headers of any of the spam email you woluld be able to know which machine actually connected to the exchange to send the email.

Sudeep
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now