Server sending 1000's of e-mails - HELP

[richcliffe]

I have a Server running Windows Server 2000 with all the latest updates etc... Last week I got a message saying the Event Log was full which is not uncommon, but after clearing it, the box was back up in 30mins or so. When I looked at the events, there were over 2000 Warnings from SMTPSVC with error number 4000. When I looked at the details, it appears that the Server is trying to send emails and the warning is saying that it was not successful. I have scanned it completely in both boot time and normal scan. I have ran 3 types of Spyware software, non of which have picked anything major up, but the problem persists. It is making the Server very slow and I'm worried that I am being used to send Spam or Phishing emails to people. Can anyone help please?

[Lisandro]

I have ran 3 types of Spyware software

Which ones?

Did you try on-line scanning?
Kaspersky (very good detection rates)
Trendmicro housecall
AVGas (does not necessary if you have AVG antispyware installed)
F-Secure
BitDefender (free removal of the malware)
HitmanPro (new online scanner with multiply scanners)

[richcliffe]

Hi
I've run Spyhunter, SpyWare Blaster and Spybot S&D. Trying some of the others now. Thanks for the tip. I have closed my port 25 and it has stopped all activity in event viewer relating to this problem. I opened it again to see if that was the reason it stopped and in less than a minute I had 900 e-mails trying to go through the server! I closed port 25 again and nothing since then. Is it possible my server was just being used as a 'relay' or is it likely to be a virus or malware of some sorts?
Thanks

[Lisandro]

SpyWare Blaster and Spybot S&D

These aren't enough.
Spyware Blaster is for immunization, not for scanning.
There are other antispyware with a better detection rate.
It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.

Trying some of the others now. Thanks for the tip. I have closed my port 25 and it has stopped all activity in event viewer relating to this problem. I opened it again to see if that was the reason it stopped and in less than a minute I had 900 e-mails trying to go through the server! I closed port 25 again and nothing since then. Is it possible my server was just being used as a 'relay' or is it likely to be a virus or malware of some sorts?
Thanks

Your computer is infected for sure...

[richcliffe]

If my computer is infected, why doesn't my Avast Server edition detect it? I thought Avast was supposed to be good!! Looks like I'll be switching to another AV software then.
Thanks

[Lisandro]

If my computer is infected, why doesn't my Avast Server edition detect it? I thought Avast was supposed to be good!! Looks like I'll be switching to another AV software then. Thanks

You won't find the perfect software, that never fails, that works 100% all the time.
Be realistic... if you get infected the virus by-pass avast protection or your avast protection is not well set.
If you need help, we'll be here. I would suggest an on-line scanning like I've posted...