Email Server Problem of

Incident:
From Block list checker: http://www.spamhaus.org/lookup/

CBL Lookup Utility

Automated/scripted bulk lookups are forbidden. Upon detection, automated scripts will be denied access, and the source IP may be listed in the CBL.

Enter an IP address:

---

IP Address xxx.xxx.xxx.xxx is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet.
It was last detected at 2014-04-04 17:00 GMT (+/- 30 minutes), approximately 4 days, 14 hours, 30 minutes ago.
It has been relisted following a previous removal at 2014-04-03 03:42 GMT (6 days, 3 hours, 20 minutes ago)
This IP is infected (or NATting for a computer that is infected) with the Conficker botnet.

Solution: Using nmap to scan problem computer
 Example Usage

# Run the scripts against host(s) that appear to be Windows
nmap --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args=safe=1 -T4 -vv -p445 <host>
sudo nmap -sU -sS --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args=safe=1 -vv -T4 -p U:137,T:139 <host>

# Run the scripts against all active hosts (recommended)
nmap -p139,445 -vv --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args=checkconficker=1,safe=1 -T4 <host>

# Run scripts against all 65535 ports (slow)
nmap --script p2p-conficker,smb-os-discovery,smb-check-vulns -p- --script-args=checkall=1,safe=1 -vv -T4 <host>

# Base checks on a different ip address (NATed)
nmap --script p2p-conficker,smb-os-discovery -p445 --script-args=realip=\"192.168.1.65\" -vv -T4 <host>

Script Output

Clean machine (results printed only if extra verbosity ("-vv")is specified):
Host script results:
|  p2p-conficker: Checking for Conficker.C or higher...
|  | Check 1 (port 44329/tcp): CLEAN (Couldn't connect)
|  | Check 2 (port 33824/tcp): CLEAN (Couldn't connect)
|  | Check 3 (port 31380/udp): CLEAN (Failed to receive data)
|  | Check 4 (port 52600/udp): CLEAN (Failed to receive data)
|_ |_ 0/4 checks: Host is CLEAN or ports are blocked

Infected machine (results always printed):
Host script results:
|  p2p-conficker: Checking for Conficker.C or higher...
|  | Check 1 (port 18707/tcp): INFECTED (Received valid data)
|  | Check 2 (port 65273/tcp): INFECTED (Received valid data)
|  | Check 3 (port 11722/udp): INFECTED (Received valid data)
|  | Check 4 (port 12690/udp): INFECTED (Received valid data)
|_ |_ 4/4 checks: Host is likely INFECTED

Source info from http://nmap.org/nsedoc/scripts/p2p-conficker.html