How to find which local process is sending spam on a Windows Server 2008 server

Question

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being made to our localhost port 25 SMTP server...which was configured to allow un-authenticated relaying. We are now requiring authentication even on 127.0.0.1:25 so the outgoing spam is blocked, but the connection attempts continue.

My guess is that one of our client's web scripts has been hacked and is being used to forward spam through our SMTP server.

Are there any tools that can be used to pin down what process, or better yet, which executable is making connections to a specific web port?

I have looked at the windows firewall logs, as suggested in this Server Fault question, but that does not list the process ID which is making connections.

Of course it is possible that I am barking up the wrong tree here, so any other advice would be appreciated too.

Answer 1

netstat -b -o lists the network connections, process and PID - you should be able to figure out which IIS worker process is doing all the port 25 connections.

Answer 2

Are you sure your server is no longer relaying spam? If you are sure it hasn't then the problem probably was just that it was an open relay. However, if you feel that some websites may be allowing spam to be sent some other way, then read on.

You may want to consider your server compromised, in which case follow the advice in the article marked as a possible duplicate above.

However, you feel it is quite likely that a script from one of your users is the cause, either because it has been hacked, or more likely that it is just poorly written allowing Email Injection type attacks.

In order to prevent your server getting blacklisted affecting all your customers, you should probably block all outgoing traffic on port 25 as soon as possible to prevent spam going out.

You are then going to have to audit all the scripts on the server to make sure they aren't vulnerable to this type of attack. See this question on Security for details of how to protect PHP scripts.

Answer 3

you can use some network sniffer tools which will pinpoint to process level which one is sending what. You can as well filter if needed.

some examples:
network monitor 3.4 (microsoft) outdated, but works well.
fiddler
... (other most probably)

Give network monitor a try and within 15 minutes you know where to look next.