Locate the machines infected by worms

[ecscomp]

Have a network that have some infected computers that sends out spam email. I have re-format some of them, but still getting blocked by Spamhaus. Can Colasoft help me? If yes how?

Thanks,
ecscomp

[Nelson]

1) You should appeal for removing your IP from the PBL on Spamhaus firstly.
2) If you have tried the first step, but still been locked, then you may consider that there are still spam going out from your network through the public IP address allocated to you, which is against the Spamhaus's policy.

You should then deploy Colasoft Capsa to monitor the traffic going out through the gateway, and see when who is sending/receiving what within your network.

[Colasoft]

Maybe this article can help: http://blog.colasoft.com/how-to-detect-email-worm-with-colasoft-packet-sniffer/