Slow and spamming

[mhigg04]

The computer is back to running as fast as it ever has. Thanks a lot for that! You have been very helpful.

Can I share a little background. I work at Hope Childrens Home (a non-profit that cares for abused and abandoned children, www.hopechildrenshome.org). The guy who helps with our computers and network no longer is able to help. He has set up all this great stuff for us, but now I am suppose to maintain it--I am out of my league. I say that to say, I am trying to figure out some things, but not sure. I think this computer is still sending out spam mail. The firewall (a checkpoint VPN-edge 1 X) is reporting this:
07827 Oct 16 09:52:27 AM TCP 192.168.2.57 2317 209.84.253.244 80 (HTTP)
07826 Oct 16 09:52:26 AM TCP 192.168.2.57 2315 209.84.253.245 80 (HTTP)
07825 Oct 16 09:52:09 AM TCP 192.168.2.57 2303 209.84.253.244 80 (HTTP)
07824 Oct 16 09:52:08 AM TCP 192.168.2.57 2301 209.84.253.245 80 (HTTP)
07823 Oct 16 09:52:02 AM TCP 192.168.2.57 2298 209.84.253.244 80 (HTTP)
07822 Oct 16 09:52:01 AM TCP 192.168.2.57 2297 209.84.253.245 80 (HTTP)
07821 Oct 16 09:51:55 AM TCP 192.168.2.57 2295 209.84.253.245 80 (HTTP)
07820 Oct 16 09:51:54 AM TCP 192.168.2.57 2294 209.84.253.244 80 (HTTP)
07819 Oct 16 09:51:49 AM TCP 192.168.2.57 2292 209.84.253.245 80 (HTTP)
07818 Oct 16 09:51:48 AM TCP 192.168.2.57 2291 209.84.253.244 80 (HTTP)
07817 Oct 16 09:51:42 AM TCP 192.168.2.57 2289 209.84.253.244 80 (HTTP)
07816 Oct 16 09:51:41 AM TCP 192.168.2.57 2288 209.84.253.245 80 (HTTP)
07815 Oct 16 09:51:36 AM TCP 192.168.2.57 2286 209.84.253.244 80 (HTTP)
07814 Oct 16 09:51:35 AM TCP 192.168.2.57 2285 209.84.253.245 80 (HTTP)
07813 Oct 16 09:51:30 AM TCP 192.168.2.57 2283 209.84.253.244 80 (HTTP)
07812 Oct 16 09:51:29 AM TCP 192.168.2.57 2282 209.84.253.245 80 (HTTP)
07811 Oct 16 09:51:24 AM TCP 192.168.2.57 2280 209.84.253.244 80 (HTTP)
07810 Oct 16 09:51:23 AM TCP 192.168.2.57 2279 209.84.253.245 80 (HTTP)
07809 Oct 16 09:51:22 AM TCP 192.168.2.55 (HCH) 4259 69.25.20.193 443 (HTTPS)
07808 Oct 16 09:51:21 AM TCP 192.168.2.55 (HCH) 4256 69.25.20.193 443 (HTTPS)
07807 Oct 16 09:51:17 AM TCP 192.168.2.57 2277 209.84.253.245 80 (HTTP)


IP 192.168.2.57 is this computer. I just pasted a little portion, but this is the same for pages every day. Do you know what this means? Do you know if it is spam? The reason why I say it is, is because our mail is being refused from hotmail, yahoo, msn, and others because we are on their blacklist. I just don't know what to do because we, of course, need to send out e-mails, but cannot to may people. Do you have any advise or help to offer, or is this just not something you can do without being here? ANy help is appreciated. If not, thanks for all your time already, you've been so awesome!

[mhigg04]

oh yea, on that firewall report, here is what the columns mean.

Source Destination
No VPN Date Time Protocol IP Address Port IP Address Port

[pskelley]

Thanks for the feedback on your computer

Here is a good link to help checking these: http://www.whois.sc/

This number: http://whois.domaintools.com/209.84.253.244
http://whois.domaintools.com/209.84.253.245

both show this: United States Sarasota Rapid Systems it appears valid as the Blacklist is Clear
You can check with your ISP if you are unsure.

This should be your private IP: http://whois.domaintools.com/192.168.2.57, your ISP should advise you there also.

I would contact your ISP and give them this information, they will be able to tell you if it is valid or not.

Beyond that, I would advise you to read the "Before you Post" instructions, especially post #5 so you understand your responsibily and ours towards your "emplorer", and then start a new topic by posting information about the issues, a HJT log and the results of a Kaspersky scan. One of our helpers will assist you as soon as possible at that point.

Thanks...Phil

[mhigg04]

Okay, I'll do that.

I read #5, most of it deals with a companie's IT dept--wish we had one!!! I'm a Bible teacher and certified counselor, not an IT guy. haha

Thanks again.