How to identify infected PC from spamming zimbra?

[bhwong]

We notice there is a huge jump in the amount of emails/spams (10x) from the zimbra daily mail report. We notice that there are a huge number of message delivery going to .it domains and huge number of messsage received from cartabcc.it.

Is there a way to block .it domains in Zimbra or even just to mark them as spam? And is there a way to block non-member domain from using Zimbra to send out emails?

Also, the top sender is from no-reply@cartabcc.it, which is not even from our email accounts. Thus, we suspect that one of our PCs might be infected. Is there a way to identity the IP address of the PC that is using no-reply@cartabcc.it to send out emails thru Zimbra?

How do you guys proceed in resolving such issues?

Thanks,
Boon Hong.

[phoenix]

Originally Posted by bhwong

Also, the top sender is from no-reply@cartabcc.it, which is not even from our email accounts. Thus, we suspect that one of our PCs might be infected. Is there a way to identity the IP address of the PC that is using no-reply@cartabcc.it to send out emails thru Zimbra?

Your daily mail report should give you a clue on which user account is sending, you can also search the log files to see where the mail is coming from (there's a command in the forums to count them, if you search). You can always scan your LAN to see if there's any infections on your PCs.

[bhwong]

Is there easier method to do this such as compiling the logs into meaningful result instead of having to search and make guess work?

[uxbod]

Why would it be guess work ? If you scan the log files to see which station is sending large numbers of emails then that is a pretty good indicator. Do you know the average number of emails your users send per day ?

[phoenix]

Originally Posted by bhwong

Is there easier method to do this such as compiling the logs into meaningful result instead of having to search and make guess work?

It's not 'guess work' it's called investigation, you could always have your logs sent to a syslog server (such as Splunk), if you have one, and analyse them in that. You could also have a look at the information provided by pflogsumm (it's provided with Zimbra and produces the daily mail report) and what options there are for getting different reports, search the internet for the web site of the author.