[ExchangeList] Re: Relaying mail but NOT an open relay... Compromised?

  • From: "Taylor, George" <GTaylor@xxxxxxxx>
  • To: <exchangelist@xxxxxxxxxxxxx>
  • Date: Mon, 17 Jul 2006 08:44:07 -0600

http://www.msexchange.org
-------------------------------------------------------Perhaps they are 
actually coming from an internal machine and spoofing
the from address, as in you have an infected machine on your
network....just a thought.

George Taylor
Systems Programmer
Regional Health Inc.


-----Original Message-----
From: Tasita Ebacher [mailto:tebacher@xxxxxxxxxxxxxxxxxxxxx] 
Sent: Monday, July 17, 2006 8:31 AM
To: exchangelist@xxxxxxxxxxxxx
Subject: [ExchangeList] Relaying mail but NOT an open relay...
Compromised?

http://www.msexchange.org
-------------------------------------------------------Hello all,


I'm working on an Exchange Server 2003 server that appears to be sending
mail like it's an open relay.  In the Message Tracking Center there are
lots of messages (a few every minute) that are from external domains
being sent to other external domains.  

The server is setup to NOT be relaying anything, and Relay tests have
proved negative for being a relay.

The client has even called Microsoft to get support on the server and
they couldn't find any problem.  I just don't see how it's relaying
mail...  Unless it's internally compromised somehow, but I can't see
anything unusual.


Has anyone ever seen anything like this before...??

I appreciate any advice!

Thank you,
TE
-------------------------------------------------------
List Archives: http://www.freelists.org/archives/exchangelist/
MSExchange Newsletter: http://www.msexchange.org/pages/newsletter.asp
MSExchange Articles and Tutorials:
http://www.msexchange.org/articles_tutorials/
MSExchange Blogs: http://blogs.msexchange.org/
-------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
-------------------------------------------------------
To unsubscribe visit http://www.msexchange.org/pages/exchangelist.asp
Report abuse to listadmin@xxxxxxxxxxxxxx 

-------------------------------------------------------
List Archives: http://www.freelists.org/archives/exchangelist/
MSExchange Newsletter: http://www.msexchange.org/pages/newsletter.asp
MSExchange Articles and Tutorials: http://www.msexchange.org/articles_tutorials/
MSExchange Blogs: http://blogs.msexchange.org/
-------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
-------------------------------------------------------
To unsubscribe visit http://www.msexchange.org/pages/exchangelist.asp
Report abuse to listadmin@xxxxxxxxxxxxxx

Other related posts: