free software to find a spambot

[austinsevo]

At work our network admin let me know that theres a Mac that is spilling spam out of the internal network. We narrowed it down to a single macbook, now i know how to find this kind of stuff on a PC. But what are my tools for finding it on the Mac? besides reformatting...

help please (-:

 

[killerrobot]

Seems like a very odd situation/problem.

You could always try clamxav.

Hope their definitions include the fix.

 

[GimmeSlack12]

I don't know for sure, but how can a Mac be a spambot?

 

[austinsevo]

I don't know for sure, but how can a Mac be a spambot?

a malicious app installed on it that includes a SMTP Engine.

 

[GimmeSlack12]

a malicious app installed on it that includes a SMTP Engine.

I figured it'd be something over my head. Sorry I can't help.

 

[angelwatt]

By chance is the MacBook running a web server? Also, check the processes in Activity Monitor to see if there are any processes that you don't recognize or can rule out with a Google search.

Sounds like the user may have been installing some shady software. Maybe even purposely.

Edit: found this thread at Apple Support, it goes along with my question about the web server, kind of.

Also, it could be a trojan if the user got a pirated copy of iWork or CS4.

 

[Roquefort]

Also, check the processes in Activity Monitor to see if there are any processes that you don't recognize or can rule out with a Google search.

A variation on that suggestion: Quit all applications on this MacBook and on another Mac that doesn't have this problem. Ideally, another MacBook. Then compare the lists of apps in Activity Monitor.

 

[austinsevo]

ok thanks guys.. im running clamxav right now.

 

[austinsevo]

ok thanks guys.. im running clamxav right now.

okay it found a trojan called irc.zapchast

 

[angelwatt]

okay it found a trojan called irc.zapchast

That only effects Windows users. So even though it's there, it can't actually do any harm on a Mac.

 

[austinsevo]

That only effects Windows users. So even though it's there, it can't actually do any harm on a Mac.

yeah i noticed that, also ran little snitch but did not find anything out of the usual.