I have a client who continues to get blacklisted. Their ISP is getting complaints that spam is originating from their IP. I have scanned all computers on the network and the server with nultiple AV and spyware scanners to no avail. I have followed all suggestions in the excellent article at http://www.amset.info/exch
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I know this is crazy but it is common for isp's to not read the headers to a message right first have the isp send you the headers of one of the messages they are having problems with this will give us some more info of timestamps and other valuable info that we can use to track it down. Please post the headers of look them over and see if it is actualy an ip of one of your locations before you stress your self out we can find it it just take a little info first.
If the traffic is going to port 80 then that would tend to indicate the machine has been compromised. If you have port 80 open to the internet then that was probably the start of the problem.
As already suggested, stop IIS and see if something is still responding on port 80, but I am afraid that the only sure fire way to remove any compromise is to wipe the system. Updating the server, scanning for viruses etc is useless - like changing the locks after the thief is inside. You have to wipe the machine to get rid of it.
Simon.
--
If your question has been answered, please remember to accept the answer and close the question.
Port 110 is POP3 server, so that could be something looking for a POP3 server to attack. It wouldn't be sending the messages out. The only way that messages go out and be delivered is on port 25 as that is what SMTP uses.
Simon.
--
If your question has been answered, please remember to accept the answer and close the question.
Business Accounts
Answer for Membership
by: SembeePosted on 2007-10-13 at 18:43:56ID: 20072565
Do you send email out via a smart host? If so then you will not see the messages in the queues. You will have to turn that off to see if the server is being abused. The most common reason though is a workstation is being abused and blocking port 25 on the firewall will show which client that is.
Simon.
--
If your question has been answered, please remember to accept the answer and close the question.