• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 765
  • Last Modified:

Exchange 2003 on SBS 2003 SMTP Queue filling with NDR's

Hi,
Been struggling with this for 2 days now. Customer was recentley infected with NetSky which was cleaned off, have since scanned and it is now nowhere to be found. Since infection though the SMTP queue is constantly filling with what appear to be NDR's from "postmaster@customersdomain.net". I have deselected "allow NDR Reports" in ESM and have also checked that we are not an open relay but no matter what i do the queue keeps filling! This is becoming a nightmare!
We are now running both SAV 9.x and aslo GFI Mailsecurity on this server and they both seem to be working fine. Dont know if its relevant but it is an SBS 2003 Box.
Have also isolated the server from the network to check they are not coming from a client but the queue still continues to fill.

Mac
0
viatron
Asked:
viatron
  • 7
  • 5
1 Solution
 
viatronAuthor Commented:
Have now also discovered that all these NDR's are to 2 addresses only 1 of which was the source of the original NetSky infection. I have added both these addresses to both receipient and sender filtering undewr message delivery and have checked that filtering is enbaqled on the SMTP connecter, have restarted SMTP and the Excchange routting service but messages keep coming!
0
 
SembeeCommented:
You need to flush out your queues.
I have a couple of techniques on how to do this on my web site: http://www.amset.info/exchange/spam-cleanup.asp

Simon.
0
 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

 
viatronAuthor Commented:
Have checked and guest is disabled, we have a firewall between the box and the outside world and as previously stated have checked we are not an open relay, or am i missing something?
0
 
viatronAuthor Commented:
Have tried the techniques on your site before i posted, good article btw. Unfortunatelyy the messages are coming so thick and fast i never manage to get an empty queue.
0
 
SembeeCommented:
It can take three or four goes to flush the queues. If the machine is isolated from the LAN then they will flush eventually. ESM is just very poor at dealing with a lot of queued messages.

Simon.
0
 
viatronAuthor Commented:
trouble is that eventually the que gets to in excess of 9k and the server becomes unresponsive ebn if left overnight, its only a small workgroup calss server used by 5 clients. Have now downloaded aqadmcli.exe and am going to try that.

Mac
0
 
viatronAuthor Commented:
Ok so followed the process for clearing the queue again, left it till it was static at nearly 24k of emails for over 2 hours, deleted all (without NDR) did an off line defrag and rebooted, within 30 minutes i have nearly 1600 emails from "postmaster@customersdomain.net" all to a single address which is the one that infected them with netsky in the first place. what i dont get is that i definatley have the tick taken out of NDR so surely we shouldnt be producing them?

HELP!

Mac
0
 
SembeeCommented:
Not unusual.

I believe that netsky can generate thousands of messages an hour. That could mean that Exchange hasn't processed them all.
Is the server totally isolated from the Internet and the network? (Physically if you have to by pulling the network cable).

Simon.
0
 
viatronAuthor Commented:
has been isolated for 3 days now, have started the flushing process....again! If i ever get hold of the guy who infected us he is dead!! I suppose its no conolation but he has had to kill his mail server and domain name as coping with up to 45000 ndrs an hour was not viable.
will run again overnight and update in the morning.

Thanks for your help
Mac
0
 
viatronAuthor Commented:
ok so left it running overnight and the result is the screenshot below,.......

http://www.viatron.co.uk/images/untitled.JPG
0
 
SembeeCommented:
Are all those messages destined for the same domain?

The scheduled state is a little worrying, which might be why this is taking so long to clear the queues.

Try creating a new connector, rather than adjust the existing one.
Change the domain entry on the existing connector, removing the * and putting in a dummy domain.

This will force Exchange to use the new connector.

Simon.
0
 
SembeeCommented:
Just going through some of the old outstanding questions as it is quiet...

Has this problem been resolved?
If you need clarification on any part of the responses above, please post back.

Otherwise you need to close the question by awarding points, or posting in the Support Topic Area (top right corner) with a link to this question asking for the moderators to close the question for you without awarding points.

Simon.
0

Featured Post

Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

  • 7
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now