Please please help, dying system (charity helpline!)

jobbingmusician

I do hope someone can help....here's the story.

We are a small charity running a website amongst other things. We have old and inadequate computers running on a server, networked broadband. We do have firewalls, antivirus etc etc.

Our ISP is Tiscali (on a very inadquate system) and our website hoster is Demon.

Our (OE) system bounces any emails we send to AOL. We keep being spammed with hundreds of emails (for example, one of our addresses had 275 this morning, and 2 further batches this afternoon - one of 200 and another of 75. When we look at the headers on these emails, they either show nothing or seem to indicate that the emails originated from us.

Our system is INCREDIBLY slow and difficult - even working offline.

We have new computers to install (but no new server). My fear is that someone has hijacked our system and is spamming from here, and that's what's freezing up our system. So I have some questions - I may not be asking the right questions and if so would be grateful to know what I need to know. But my questions so far are

1. How can I tell for sure if we've been hijacked? Should I be talking to Demon?

2. Supposing we have been hijacked. What exactly is hijacked? Will changing our computer system in the new year solve the problem (because the virus/nasty is in a computer) or is the problem with our ISP address, and if so what do we do?

It would be very helpful if any replies could be kept in VERY VERY simple language!!!

Thanks for reading - any help welcome as whatever the fault is, is really sabotaging the work of the charity atm!

newfoundglory

Its possible you have viruses or trojans on the system, but since you have antivirus (assuming you DO keep it up to date on your computers with the latest virus definitions), I think it is perhaps unlikely. If these were present, they would be looking at any email lists and sending spam or viruses to those contacts in your email lists.

You see, what you have to understand is that email is in no way secure. This goes for pretty much the majority of the internet. So when an email has said it has come from a particular "address", that address should not be trusted - because if you know what you are doing you can change many things and make it appear to have come from virtually anywhere. It may have appeared to originate from you, but in fact you may not have even sent it.

You say you are running a website. Its a mistake to put email addresses on a website in plain form. Web crawlers (programs which walk about the internet) do this looking for email addresses to spam. They get collected off web pages and are placed on large spamming lists.

You should consider using web forms on your web pages, where people can submit information in order to contact the charity - so that the email address is hidden. I'm sure you have seen when registering on various sites that you are required to input a random string of characters and a letters which appear as an image before you are allowed to submit a form. This is used to prevent web crawlers from injecting information into forms and submitting those.

There are various ways of implementing servers and software etc. But other things to consider are antispam software on a server perhaps. Maybe consider looking at other operating systems and free software such as Linux and Unix which can be used as powerful file servers, webservers, proxies and firewalls. You might like to implement a unix-based server with the desktop machines that people actually use as microsoft windows machines which connect to the unix servers.

gavinp

If you want to check to see if your mail server is being used to relay spam, you can use this site to test it:

http://www.ordb.org/

The other option is that one of your PCs is infected with a trojan and is acting as a drone to send out spam. Try turning off one PC at a time and see if the speed of your broadband increases. Check the anti-virus software is up-to-date and run a full scan on all machines.

You may however find that someone is spoofing your email address i.e. sending messages pretending to be you - and the messages you are getting back are delivery failure messages.

Thanks

Gavin

alanrowell

The problem with turning off one computer at a time is that it's likely multiple computers are infected.

If I was you I'd update your antivirus, firewall, anti-spyware on each computer then disconnect each computer from the network, turn off system restore and shut the computer down.

Then I'd start up each computer in safe mode and run the antivirus & antispyware to ensure that each computer is clean

Then I'd reboot normally & reconnect one computer to the network to see what happens.

If, after several hours nothing "odd" is happening then it should be safe to turn system resore back on & to reconnect the remaining computers to the network

tigermatt

jobbingmusician wrote:

Should I be talking to Demon?

No, it is most likely going to be your ISP (Tiscali) that you need to talk to if the problem is coming from them.

However, (as said in previous posts) it may be trojans or viruses etc. that are sending hundreds of emails at random intervals throughout the day from your computers. This might be confirmed by the fact the messages appear to come from your system. However, don't rely on this - anyone can spoof an Email to make it "look like" it has come from almost anywhere.

I recommend ensuring you update your AntiVirus software (not just "Critical" or "Urgent" updates but every update) to its latest Virus Definitions and Program release, then run a full scan on each of your computers. If it picks up anything, you should remove it and see what happens. If it doesn't pick up anything, then post back. What Anti-Virus software are you running?

I hope you find a resolution to your problem. Matthew