joshcomley's questions

My Windows 2008 server is attempting to send out a lot of spam, I've just discovered, and I'm not sure how to see where the compromise is. For example: has someone hacked an account? Has someone hacked the server? Is there a virus on the server?

What can I do to investigate this?

Edit

Thanks for the replies so far. I am running hMail server, and have spent so long investigating the correct configuration but still I end up with these emails being sent.

Here is a screenshot of my Internet IP range settings on the server:

(let me know what else I can provide to help)

I'm trying to capture the output of the remote process from psexec (i.e. not psexec's own output). So, for example I could run "ipconfig" and print the output to a log file.

I have tried:

psexec \\myserver ipconfig > output.log
psexec \\myserver ipconfig >> output.log
psexec \\myserver ipconfig 2> output.log
psexec \\myserver ipconfig > output.log 2>&1

The last just gives the psexec output.

I'n not sure what the differences are between all of these, but I've seen them suggested in my hunt for the answer elsewhere.

Can anybody give me an example command line that will capture the output of ipconfig to a file??

Edit 1: I want the log file to be saved on the local machine, not the remote one.

Edit 2:

Here is what I get from running "psexec \\myserver ipconfig":

C:\TempDll>psexec \\myserver ipconfig

PsExec v1.95 - Execute processes remotely
Copyright (C) 2001-2009 Mark Russinovich
Sysinternals - www.sysinternals.com


ipconfig exited on myserver with error code 0.

C:\TempDll>