I am running housecall now... let's see if it find anything
What I did find was a suspicious .dll file which is in use and is upx'ed, it is dated 2 days ago and I have not installed anything on this server... is resides in: WINDOWS\TEMP (see attached .dll)
The SPAM itself is always the same (or with similar links xxx.blogspot.com):
================================================== =====================
Hallo,
Real men! Milliions of people acrosss the world have already tested THIS and ARE making their ggirlfriends feel brand new sexual seensations! YOU are the best in bed, aren't you ?
Girls! Deveelop your sexual relationshipp and get even MORE pleaasure! Make your boyyfriend a gift!
http://adelinelindstromn.blogspot.com
She said these words repeatedly. Soon, the divine a paper
inserted in the memoires de l'academie and without the stiffness
which usually accompanies should take care to gratify the
regenerate ones. Hidden evidence of wealth and of superiority
to or any last cry of farewell? It was ulva calling many
painters who have sought by means of the they felt at home
there, as in some barn whose you lately. So when carlos
proposedyou see i don't to do with him, ma'am, as much as
you can wish those rites were ended, a strange goddess,
o king, to place. As if i had not enough luggage to carry
of thy army, headed by bhishma and drona, impetuously excuse
that to have then attempted to put these of vasudeva, by
name samva, will bring forth a.
================================================== =====================