• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 510
  • Last Modified:

Exchange sending SPAM

Im running Exchange 2000 server. The mail queue keeps filling up with spam. Relay is not open. Guest account is disabled.

I even removed it from the network, and the queue continues to fill up. Have done a complete AV scan and nothing.

Also if i do find the problem, is there an easy way to clean the queue?


Please help.
0
joh2900
Asked:
joh2900
2 Solutions
 
OneHumpCommented:
There is something spammers do called a dictionary harvest attack.  It's common and Exchange is a weak SMTP perimeter server so there is little you can do within Exchange to prevent it.

What happens is address list harvesters run through the dictionary @yourdomain.com and count up rcpt to: commands that are accepted.  The result is a queue full of spam and a badmail folder full of messages that couldnt be returned because they send from an invalid address.

Your best bet is to deploy a better perimeter solution in front of your Exchange server.  Tumbleweed, Trend, Ironport, ChipherTrust and Postini all have decent solutoins.  There are many others as well.

OneHump
0
 
joh2900Author Commented:
its offline and still queing mail.??
0
 
visioneerCommented:
Exchange seems to be prone to attacks based on the authentication methods on the SMTP server.  You should check the properties of the Default SMTP Virtual Server, go to the Access tab, click Relay, and UN-check the box that reads "Allow all computers which successfully authenticate to relay, regardless of the list above."  Let us know if that makes the spam subside.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
joh2900Author Commented:
changing authentication didnt help..... It almost seems as if somethings creating the emails from within that server... The server isnt even plugged into the network.

Have done a comlete scan with 2 different engines and both come up blank..
0
 
David WilhoitCommented:
unplugging the server won't make this go away, those queues need to be emptied out manually.

d
0
 
OneHumpCommented:
Email is not queing whent he server is offline.  What is happening is that email is being processed through your queues.  You won't always see them in ESM even though they are there.  There is a resource kit tool called MailQ you can use to get a better view of your queues.

Nothing with authentication, nothing with an open relay; This is a textbook dictionary attack.

OneHump
0
 
OneHumpCommented:
Where are we at with this?

OneHump
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now