Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being made to our localhost port 25 SMTP server...which was configured to allow un-authenticated relaying. We are now requiring authentication even on 127.0.0.1:25 so the outgoing spam is blocked, but the connection attempts continue.

My guess is that one of our client's web scripts has been hacked and is being used to forward spam through our SMTP server.

Are there any tools that can be used to pin down what process, or better yet, which executable is making connections to a specific web port?

I have looked at the windows firewall logs, as suggested in this Server Fault question, but that does not list the process ID which is making connections.

Of course it is possible that I am barking up the wrong tree here, so any other advice would be appreciated too.

share|improve this question
    
possible duplicate of How do I deal with a compromised server? –  EEAA Apr 8 '13 at 1:48
    
@EEAA A script sending spam from a hosted website is not the same as a compromised server. –  HopelessN00b Apr 8 '13 at 2:20
    
Check procmon and/or process explorer from the sysonternals suite for more in depth monitoring and tracking of your server's processes. –  HopelessN00b Apr 8 '13 at 2:21
    
@HopelessN00b - it might not be, but I'd not be willing to take that chance. –  EEAA Apr 8 '13 at 2:30
add comment

1 Answer

Are you sure your server is no longer relaying spam? If you are sure it hasn't then the problem probably was just that it was an open relay. However, if you feel that some websites may be allowing spam to be sent some other way, then read on.

You may want to consider your server compromised, in which case follow the advice in the article marked as a possible duplicate above.

However, you feel it is quite likely that a script from one of your users is the cause, either because it has been hacked, or more likely that it is just poorly written allowing Email Injection type attacks.

In order to prevent your server getting blacklisted affecting all your customers, you should probably block all outgoing traffic on port 25 as soon as possible to prevent spam going out.

You are then going to have to audit all the scripts on the server to make sure they aren't vulnerable to this type of attack. See this question on Security for details of how to protect PHP scripts.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.