Virus Sending out Spam

I've got a client that may have a virus on one of their PC's sending out Spam. They have an off-site Spam filtering service that generates reports and shows Spam outgoing every night from about 11:00 PM to 8:00 AM. All their log shows is it coming from their Outside interface not specifically which PC. It does block the outgoing Spam but we're concerned it may be a virus. I've run their Trend Antivirus and Malwarebytes scans on all PC's and didn't find anything.

I had this same problem with another client but they had a Watch Guard Firewall that had a realttime log you could watch and refresh and I just watched it for a  few minutes and saw traffic on port 25 from a specific IP address that wasn't their mail server and was able to find the PC that way.

This client doesn't have that. I waswondering if there is some simple program out there I could install that would monitor their network for SMTP traffic and generate some sort of log. I've looked at programs like PRTG but I don't have 3 weeks to learn how to interepret the data it appears to generate. I just want to isolate which PC is sending out email traffic in the middle of the night. Is there anything like that available?

Axis52401Security AnalystAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

Sudeep SharmaConnect With a Mentor Technical DesignerCommented:
And what Anti-Virus solution they are using?

Is logging enabled on Exchange server?

You could check the logs if emails are being send out from exchange, that would include the IP address of the host machine (system sending out spam)

Or if their SPAM Filter could send the details report of the emails which are sent, if you could get the headers of any of the spam email you woluld be able to know which machine actually connected to the exchange to send the email.

Easiest way without spending a boatload of money would be to introduce a hub (not a switch, unless you have a manageable switch that does port mirroring) in between the network switch and internet router.

Hubs broadcast all traffic to all connected ports, so you can plug in any computer and run wireshark (free from to sniff packets. It'll be pretty easy to narrow down your port 25 traffic from there.
Axis52401Security AnalystAuthor Commented:
I don't see getting a hub as an option here, I'm not physically onsite and lm doing this remotely and I'd rather not have them putting in networking equip over the phone.
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Without either a hub or a mirror port, there's no way to monitor the traffic. Switches don't broadcast unicast traffic to all machines on the network, so you'll never get a full view of traffic without the right hardware.
Sudeep SharmaTechnical DesignerCommented:
DO you have exchange server and firewall in place?

Does all the spam messages are routing from Exchange?

I mean does the infected PC sending email to Exchange and Exchange routing them to Internet?

Axis52401Security AnalystAuthor Commented:

   The only reason I know about it is that the offsite SPAM filter they use sends out a report each day with what it blocked and we keep getting reports that Spam starts to get sent out about 11PM and stops about 8AM. They do use Exchange but I can't tell if it's routing through the server or going directly out from one of the workstations (I have seen both in the past)
    I'm trying to find a way of narrowing down which PC or server it may be coming from.
Axis52401Security AnalystAuthor Commented:
Oh and their only 'firewall' is a DSL modem with limited firewall abilities.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.