You could also try running a network scan using wireshark to identify the infected host...

On 30 June 2010 16:27, Tony Gacheru <tonyg@arcnetkenya.com> wrote:
redirect all smtp traffic to a smarthost and block the offending users from
there.

-----Original Message-----
From: skunkworks-bounces@lists.my.co.ke
[mailto:skunkworks-bounces@lists.my.co.ke] On Behalf Of ibtisam jamal
Sent: Wednesday, June 30, 2010 4:15 PM
To: Skunkworks Mailing List
Subject: Re: [Skunkworks] Public IP blacklisted

It's kind of tricky because the network is divided in three
-Office LAN
-Corporate clients (Fixed Broadband) users
- Packet Core (SGSN's)

The IP's blacklisted are virtual IP's of the GPRS network .
We allow customers to browse anything no rules but we do have
firewalls for protection.
Customers use dynamic IP's .

So how do we solve it .





On Wed, Jun 30, 2010 at 4:03 PM, Steve Muchai <smuchai@gmail.com> wrote:
> On Tue, Jun 29, 2010 at 2:40 PM, Nawaz Bagha <nawazb@gmail.com> wrote:
>> had something similar in our office... ask your ISP to change your
IPs....
>> and then redirect any AX/MX records to the new IP... And try getting an
>
> Not a particularly good idea, just running away from the problem. Your
> new IP will get blacklisted anyway.
>
> I've seen very helpful posts, cleaning your network is the way to go.
> Out of curiousity, what's your setup like (what router do you use,
> does your server have public IPs or is SMTP dnat'd from the router,
> etc). With more details folks here will suggest exactly what to do.
>
> BR,
> S
>
> --
> This message represents the official view of the voices in my head.
> _______________________________________________
> Skunkworks mailing list
> Skunkworks@lists.my.co.ke
> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks
> ------------
> Skunkworks Server donations spreadsheet
>
http://spreadsheets.google.com/ccc?key=0AopdHkqSqKL-dHlQVTMxU1VBdU1BSWJxdy1f
bjAwOUE&hl=en
> ------------
> Skunkworks Rules
> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94
> ------------
> Other services @ http://my.co.ke
>
_______________________________________________
Skunkworks mailing list
Skunkworks@lists.my.co.ke
http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks
------------
Skunkworks Server donations spreadsheet
http://spreadsheets.google.com/ccc?key=0AopdHkqSqKL-dHlQVTMxU1VBdU1BSWJxdy1f
bjAwOUE&hl=en
------------
Skunkworks Rules
http://my.co.ke/phpbb/viewtopic.php?f=24&t=94
------------
Other services @ http://my.co.ke


--

_______________________________________________
Skunkworks mailing list
Skunkworks@lists.my.co.ke
http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks
------------
Skunkworks Server donations spreadsheet
http://spreadsheets.google.com/ccc?key=0AopdHkqSqKL-dHlQVTMxU1VBdU1BSWJxdy1fbjAwOUE&hl=en
------------
Skunkworks Rules
http://my.co.ke/phpbb/viewtopic.php?f=24&t=94
------------
Other services @ http://my.co.ke