RE: SBS 2000 and Exchange 2000 Creating Large Amounts of Spam

  • From: "John Tolmachoff \(Lists\)" <johnlist@xxxxxxxxxxxxxxxxxxx>
  • To: "'[ExchangeList]'" <exchangelist@xxxxxxxxxxxxx>
  • Date: Mon, 8 Sep 2003 12:46:30 -0700

Have you checked the SMTPsvc log for incoming and outgoing?

How have you checked that you know your server is not an open relay?

What is the server IP address (send of list if you want) and I can check if
it is listed in any spam databases, which would indicate it was or is an
open relay?

John Tolmachoff MCSE CSSA
eServices For You

> -----Original Message-----
> From: Richard Parsons [mailto:rick@xxxxxxxxxxxxxxxxxx]
> Sent: Monday, September 08, 2003 8:05 AM
> To: [ExchangeList]
> Subject: [exchangelist] SBS 2000 and Exchange 2000 Creating Large Amounts
> Spam
> I am running SBS 2000 which includes Exchange 2000 Server together with
> ISA server 2000 as a package it works well, Suddenly all is not well my
> system seems to have been hijacked.
> When checking the server (because of a mail go slow) I discovered the SMTP
> virtual server Outbound queue full of SPAM (ie the standard "viagra", "get
> out of debt", "porn chick" stuff, addressed to aol, hotmail, and many
> others etc).
> After eliminating all other sources, ie scanning all PC's for viruses,
> disconnecting all workstations from the network,and the server from my
> adsl connection etc, I have discovered that the server seems to be
> creating the spam itself. This is based on the fact that the server is now
> totally disconnected from the network and the internet(ethernet cables
> unplugged), the queue has been deleted, and as soon as I restart the SMTP
> service, within a minute there are a 1000 email messages in the queue.
> I have double checked that my server is not acting as a third party
> relay,(and it is not) The Server Has all patches/latest updates/sbssp1/sp4
> for wk2/sp3 for exch2k etc,etc
> I have run a thourough virus scan on the server, but found nothing.
> When I stop the SMTP service, the messages stop being generated, as soon
> as I start it again, the messages start being generated.
> Any idea's PLEASE !
> ------------------------------------------------------
> List Archives:
> Exchange Newsletters:
> Exchange FAQ:
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory:
> No.1 ISA Server Resource Site:
> Windows Security Resource Site:
> Network Security Library:
> Windows 2000/NT Fax Solutions:
> ------------------------------------------------------
> You are currently subscribed to this Discussion List as:
> johnlist@xxxxxxxxxxxxxxxxxxx
> To unsubscribe send a blank email to leave-exchangelist-
> 1440469J@xxxxxxxxxxxxx

Other related posts: