Solved

How to find a Spam Generatir in my Network

Posted on 2011-03-13
8
335 Views
Last Modified: 2012-05-11
Dear Experts

i am running most of my clients on Windows XP with Syamantec Endpoint Virus Protection & having Exchange 2003 Enterprise Server, from last few days I have constatnly been black listed on various spam engines, shown at MXTOOLBOX, How can I check which of the computer is generating these thousands of spam messages.

I have run a relay check & found that relay is not allowed, I have also blocked the HTTP & HTTPS access to my mail server from outside.

Please Help.
0
Comment
Question by:inteq
8 Comments
 
LVL 11

Accepted Solution

by:
Pieter Jordaan earned 250 total points
ID: 35125946
Hi

I had a similar problem a while ago, and found a computer on my network that delivers email straight to the mail server port 25. It could manipulate the entire email, including from, to and attachments.

We had to configure exchange connectors for all the authorized mail hosts, and block everything else.

I found the computer by changing the mail server IP address, and then configuring a pfsense firewall to use the IP address so that I could filter through the connections, and forward packets to exchange.

There must be a simpler way to find the machine / machines that are delivering the emails.
I did not look at Windows tools to do that.

The simplest would be to change the exchange connector to only accept emails from specified IP addresses, or to block your LAN IP range on that port.

Depending on the size of your network, you could try a different Anti-Virus, like AVG - http://free.avg.com to try and find it. I haven't had good luck with viruses using Syamantec. I'm sure AVG will pick up virusses that Syamantec missed.

Good luck.
0
 
LVL 23

Assisted Solution

by:phototropic
phototropic earned 250 total points
ID: 35126016
0
 
LVL 11

Expert Comment

by:Pieter Jordaan
ID: 35126106
True.

I suppose the 30 day trial will also do the trick.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 23

Expert Comment

by:phototropic
ID: 35423969
Please share points with BitFreeze.  His initial post is the meat and potatos of this answer.
0
 
LVL 38

Expert Comment

by:younghv
ID: 35424169
Sorry - thought I selected the "Split" option.
I am going to "Object" to this, so a Moderator can make that happen.

Good call - thanks.
0
 

Expert Comment

by:ModernMatt
ID: 35455459
Starting the process to split the points.

Thanks, all!

ModernMatt
Experts Exchange Moderator
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

So you got the Conficker. You could go to each machine and run the eye chart test (http://www.confickerworkinggroup.org/infection_test/cfeyechart.html), but in a bigger environment, or if you prefer to work smarter and not harder, you need some …
Some site administrators might be considering how to filter incoming traffic to a site by identifying the domains or networks of the traffic source, in the same way that a spam filter does on an email server, such as blocking all emails sent from th…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now