remove the user from the network. then check out the pc...
============
Best practice is to: Block outbound SMTP (port 25) traffic to/from all devices other than your mail server(s). Implement endpoint firewall/AV software that does not permit traffic on port 25. Scan the system in question with <a href="http://www.microsoft.com/security_essentials/">Microsoft Security Essentials for free</a> AV protection.
Last Wiki Answer Submitted: August 13, 2010 12:07 pm by jinteik15,485 pts.
If you live outside the United States, by submitting your email address you consent to having your personal data transferred to and processed in the United States.
You might want to clarify the question, so we don’t need to assume what the problem is. Also, let us know what troubleshooting steps you have taken so far, so we don’t suggest things you have already tried.
If a machine is generating spam, then you should disconnect it from the netowork and scan it for malware. If you already did it, then do it again with another anti-malware program.
For better results you should install and update the anti-malware program of your choice, then restart the machine in safe mode without networking, and then do the full scan.
Please read my suggestion above about blocking port 25 outbound at your network edge. This will help keep your network off blackhole lists.
Assuming this is a Windows machine: (if not please provide additional details about system config)
You can run netstat -no at a command prompt on this machine to see what process (PID) is connecting to port 25 on a remote system. Once you get the PID number, run tasklist at the command prompt also to get the name of the process connected to port 25.
For example the following shows how to find out the process connected to a remote system on port 5900 (VNC)
netstat -no
Active Connections
Proto Local Address Foreign Address State PID
TCP 10.11.50.33:445 10.11.99.11:1064 ESTABLISHED 4
TCP 10.11.50.33:5441 10.11.99.11:445 ESTABLISHED 4
TCP 10.11.50.33:5617 10.11.18.2:5900 ESTABLISHED 3544
TCP 127.0.0.1:60164 127.0.0.1:60165 ESTABLISHED 5532
TCP 127.0.0.1:60165 127.0.0.1:60164 ESTABLISHED 5532
TCP 127.0.0.1:60166 127.0.0.1:60167 ESTABLISHED 5532
TCP 127.0.0.1:60167 127.0.0.1:60166 ESTABLISHED 5532
tasklist | find "3544"
vncviewer.exe 3544 Console 1 8,676 K
Thanx for support but i cant remove that pc any other solution?
if you have antivirus then do a full scan on the pc..
its done already
You might want to clarify the question, so we don’t need to assume what the problem is. Also, let us know what troubleshooting steps you have taken so far, so we don’t suggest things you have already tried.
If a machine is generating spam, then you should disconnect it from the netowork and scan it for malware. If you already did it, then do it again with another anti-malware program.
For better results you should install and update the anti-malware program of your choice, then restart the machine in safe mode without networking, and then do the full scan.
Please read my suggestion above about blocking port 25 outbound at your network edge. This will help keep your network off blackhole lists.
Assuming this is a Windows machine: (if not please provide additional details about system config)
You can run netstat -no at a command prompt on this machine to see what process (PID) is connecting to port 25 on a remote system. Once you get the PID number, run tasklist at the command prompt also to get the name of the process connected to port 25.
For example the following shows how to find out the process connected to a remote system on port 5900 (VNC)