Being accussed of being spammer

[excoach]

Since completeing patching of Groupwise 6.5 (not sure this is reason) we have been being placed in the SPAMHAUS.com database under 'XBL'. There explanation is we have a computer with a virus that is sending out messages.

I have scanned all computer and have not found a virus. Not being an expert we also changed the ip address that the world see from our workstation. We then used a different ip address from the mail server.

I removed the desktop IP from the 'XBL' but the new server IP address the world see is now in the 'XBL'

To make a long story short are there any files in Groupwise that may tell me where these spam could be coming from.

Again I by far not an expert.

Thanks

 

[blister911]

It could be that you are allowing relaying on the GWIA.
It could also be that one of the workstations has been infected with a mass mailing virus and is sending spam directly to the interent...not going through GroupWise. You would have to watch your firewall to see what's going out to see.

 

[marvhuffaker]

Yeah it may have nothing to do with GroupWise. A good deterrent for this type of Spam (Virus / Worm on workstation) is to block all Port 25 outbound traffic EXCEPT from your GWIA server.



Marvin Huffaker, MCNE

http://www.redjuju.com

 

[excoach]

Thanks for your replies.
The problem was we had a consultant in to do upgrades and after the upgrade completed our system was sending our ip address out instead of our domain. This caused SPAMHAUS to view us as a spam site. I changed the GWIA setting "A Record Name" from the IP address to our domain name. This fixed our problem.

 

[marvhuffaker]

Damned consultants.





Marvin Huffaker, MCNE

http://www.redjuju.com

 

[smoppett]

Have you been able to quantify your time spent, so that you can invoice the consultant and contra that value off their bill?