I was thinking you spotted the problem and reinstalled your server? You know of course there is no fix for a compromised server?

Hi,
I have been through the same ordeal you described. My clients kept on getting blacklisted on spamhaus and/or spamcop.net for no apparent reason. However, the last rule you posted will solve your problem:

iptables -I FORWARD -m tcp -p tcp --dport 25 -j DROP

The problem is being caused by a botnet infection on your LAN. Its a windows virus that comes packaged with a spam engine. It spends a couple of hours enumerating domains to attack by quering MX entries for domains then all at once sends a massive amount of spam. That rule ensures that your LAN PCs cannot directly send mail through your gateway. What happens is the generated message gets NATed from the gateway.

Try typing iptables -vL and look at the byte counter for your FORWARD chain. I bet you'll see a number in the Ks or Ms.

You can find out which PCs are causing the problem with iptraf. Ofcourse that means you'll temporarily need to remove the DROP rule in the FORWARD chain. Any single private IP trying to send packets to the 25 port of a number of different public IPs is a winner

edit: Although I doubt it, you could check if your system has any backdoors installed with rkhunter.

Hi all ;-)

I finally came out of this mess.
I painfully decided to format all of the machines,backed as much data as I could but losed so much of applications and some data.

For the few days since I did this am now clean in all those spam databases.

I just want to thank all who supported me in advice thro' this.Keep this spirit of sharing..

___________
make sure before you reinstall the backups that you don't reinfect your systems. Run antivirus and also a few different rootkit detectors (no one detector is perfect) on your backed-up files first.