Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1452
  • Last Modified:

Spam from Windows 2008, MailEnable and Plesk 10.4

Hi,

I´ve a spam problem on one Windows 2008 server using plesk and mailenable, a huge amount of e-mails are being sent from localhost, localhost is allowed to relay.

The spamming proccess connecting to mailenable have PID 0, how should I do to find which scripts are the responsible for sending these e-mails?

I hope you could shed some light on this.

Thanks
Martín
0
mzanlongo
Asked:
mzanlongo
  • 2
1 Solution
 
btanExec ConsultantCommented:
PID. 0 normally represent system idle process that never ends, you can see it in process explorer or task mgr...strange though as mailenable has anti spam capability
http://www.mailenable.com/features/anti-spam.asp

There are log to check
http://www.mailenable.com/kb/content/view.asp?ID=ME020280

Some useful tools to trace down further, pls see this http://www.mailenable.com/kb/Content/Article.asp?ID=me020168

Probably also check AV log and event viewer for any errors.
0
 
mzanlongoAuthor Commented:
Hello, thanks for your answer.

If I do a netstat -n -p tcp -o during the spam event I can see the PID 0 connecting a lot of times to the port 25 (smtp), I knew the PID 0 is the IDLE process... I just want to know how to trace the process behind PID 0, maybe svchost or something else.

Martín
0
 
btanExec ConsultantCommented:
Understand that Netstat  option -b will display the process's actual file name
http://pcsupport.about.com/od/commandlinereference/p/netstat-command.htm

See if this is helpful using taskmgr and TCPView
http://www.sans.org/security-resources/idfaq/mapping-ports.php
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now