I am desperate and in need of help!!!

L1n3arA · 02-21-2009, 02:06 PM

Hi, before I start, I would just like to apologize before hand if this is not the correct forum in which I should solicit help with the issue I am having.

Pretty much my problem is that about 10 Days ago Comcast (my isp) permanently blocked port 25 to stop all outgoing email. They have informed us of huge amounts of email being sent out from our ip and is considered to be spam. I scrawled google and other forums for answers before making an attempt on my own, but I am desperate and am in somewhat of a hurry to make this stop as soon as humanely possible. Pretty much what I am suspecting thus far, is that one of the computers in our home might be functioning as an open relay to send out spam unknowingly. Since there are about 3 computers left on at almost all times this seems like a possibility.

Please I am begging anybody with some know-how and a little patience to explain what measures I can take to stop this and what programs etc or tutorials might assist me.

**johnwill** · 02-22-2009, 12:11 PM

Well, you really need to resolve this with Comcast or change ISP's. If you have an infected computer, the first step is to find it and fix it.

Use webmail until you resolve the issue.

asgley · 02-27-2009, 05:42 AM

lets find out what machine is sending the mail...
I will assume all your machines are running windows
try the following
Start --> Run --> 'cmd' --> 'netstat -a'
look for Foreign Address that are :25 or :SMTP

this may work, if you have an infected computer that is spamming i would expect it to be constantly trying to connect to mail servers and should show up here.
If this fails to give you any useful results you can do one of a few things, you can install a firewall block outbound traffic to dst port 25 and set it to log all these blocks, or you can install something like wireshark and set it to sniff and filter for SMTP traffic and let it run for a few hours/days.
if you have a linux firewall then you can use iptables to reject the outbound traffic to dport 25 and log the requests. then look at the source ip and see what machine it was from.

hope this is useful

Asg

ThePistonDoctor · 03-02-2009, 01:34 PM

Personally, I'd go with the wireshark option because it's simpler if you know how to use the app. Netstat -a will also give you a bit of info though.

02-21-2009, 02:06 PM	#1 (permalink)
L1n3arA Registered User Join Date: Feb 2009 Posts: 1 OS: Windows Vista 32bit	I am desperate and in need of help!!! Hi, before I start, I would just like to apologize before hand if this is not the correct forum in which I should solicit help with the issue I am having. Pretty much my problem is that about 10 Days ago Comcast (my isp) permanently blocked port 25 to stop all outgoing email. They have informed us of huge amounts of email being sent out from our ip and is considered to be spam. I scrawled google and other forums for answers before making an attempt on my own, but I am desperate and am in somewhat of a hurry to make this stop as soon as humanely possible. Pretty much what I am suspecting thus far, is that one of the computers in our home might be functioning as an open relay to send out spam unknowingly. Since there are about 3 computers left on at almost all times this seems like a possibility. Please I am begging anybody with some know-how and a little patience to explain what measures I can take to stop this and what programs etc or tutorials might assist me. Last edited by L1n3arA; 02-21-2009 at 02:12 PM.

02-22-2009, 12:11 PM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,654 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: I am desperate and in need of help!!! Well, you really need to resolve this with Comcast or change ISP's. If you have an infected computer, the first step is to find it and fix it. Use webmail until you resolve the issue. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

02-27-2009, 05:42 AM	#3 (permalink)
asgley Registered User Join Date: Feb 2009 Posts: 105 OS: xp32, vista64, gentoo, rhle4, rhel 5 64, centos 64, debian, solaris, 2k3, 2k8	Re: I am desperate and in need of help!!! lets find out what machine is sending the mail... I will assume all your machines are running windows try the following Start --> Run --> 'cmd' --> 'netstat -a' look for Foreign Address that are :25 or :SMTP this may work, if you have an infected computer that is spamming i would expect it to be constantly trying to connect to mail servers and should show up here. If this fails to give you any useful results you can do one of a few things, you can install a firewall block outbound traffic to dst port 25 and set it to log all these blocks, or you can install something like wireshark and set it to sniff and filter for SMTP traffic and let it run for a few hours/days. if you have a linux firewall then you can use iptables to reject the outbound traffic to dport 25 and log the requests. then look at the source ip and see what machine it was from. hope this is useful Asg

03-02-2009, 01:34 PM	#4 (permalink)
ThePistonDoctor Registered User Join Date: Mar 2009 Posts: 58 OS: XP	Re: I am desperate and in need of help!!! Personally, I'd go with the wireshark option because it's simpler if you know how to use the app. Netstat -a will also give you a bit of info though.