Spam FROM LOCAL [127.0.0.1]-Content-filter

[kuldippchavan]

Hi, am in facing issue with my Zimbra 8.6 Open source now. on my admin email account from last two days 500+ spam mail coming from local hots. i need help

header content:-
Return-Path: <payp@int2l.payp.com>
Received: from localhost (localhost [127.0.0.1])
by mail.ymkrishna.com (Postfix) with ESMTP id D2F46201ECAB9;
Wed, 13 Dec 2017 00:36:41 +0530 (IST)
X-Virus-Scanned: amavisd-new at ymkrishna.com
Received: from mail.ymkrishna.com ([127.0.0.1])
by localhost (mail.ymkrishna.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id 9_pblV0AefXc; Wed, 13 Dec 2017 00:36:41 +0530 (IST)
Received: from 246.174.51.186 (gateway [190.90.10.1])
by mail.ymkrishna.com (Postfix) with ESMTP id 105B4201ECAB8;
Wed, 13 Dec 2017 00:36:13 +0530 (IST)
From: PayPal Support <payp@int2l.payp.com>
Subject: Validate your records.
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.8028
X-Mailer: Microsoft Outlook Express 6.00.2600.8028
Message-ID: <603231D16CE043FD110679D4D7AFDBEE@gy4c8eo2Umc.us>
Content-Type: multipart/mixed; boundary="_NextPart_000_0096_2C1F87A5.CA28C48A"
Date: Wed, 13 Dec 2017 00:36:13 +0530 (IST)

[thedead106]

have you tried using lsof to check your local machine and see where the mail is really coming from you may have a worm.

[kuldippchavan]

not tried. please guide me how to troubleshoot this

have you tried using lsof to check your local machine and see where the mail is really coming from you may have a worm.

[kuldippchavan]

not checked. please guide me how to check lsof