Solved

how did a spam email generated and sent from my server?

Posted on 2006-06-15
5
311 Views
Last Modified: 2011-09-20
my server is windows 2003 with exchange 2003. last couple days, number of accounts has sent out mails like these below samples. i can't figure out how it happen or if my server is infected or local user machines are infected with viruses. the email was sent out using authorized account and sent to the same account under alias address as below. different subject and body content were sent out each time.

From: Jeanine [mailto:firname_lastname@domainname.com]
Sent: Wednesday, June 14, 2006 1:55 PM
To: firstname lastname
Subject: RE: yOur pi11z r3quest
Importance: High

HOw are yOu Guys?!

Please open your mind for a simple thing
Internet provided products always cheaper than others.
You may agree or not, but this is a fact
Just compare the numbers and get the same goods for a half value
You may agree or not, but this is a fact

0HNiTsfUebnAZb9XR4DM
0
Comment
Question by:cuc888
  • 2
  • 2
5 Comments
 
LVL 8

Expert Comment

by:smeek
Comment Utility
Enable message tracking on your server properties in ESM.  Query on the next message you receive.  This is to make sure the messages were not just spooked emails (crafted to look like they came from your server).

You might also check and make sure the guest account in your domain is enabled?

You should also check and see if your server is an open relay.
http://www.abuse.net/relay.html

Steve
0
 
LVL 104

Expert Comment

by:Sembee
Comment Utility
Are you sure that the messages are coming from your server? You need to see the header information to confirm if they have originated off your machine, or the messages are spoofed.

If you are sure, then it could be either an open relay or authenticated user. If the machine is being used you can usually tell as there will be a large number of messages in the queues.
Authenticated user attacks are usually against the administrator account, so change that account password.
If you don't have any users outside relaying through your server with Outlook Express or similar SMTP product, then you don't even need authenticated relaying and can turn it off.

Simon.
0
 

Author Comment

by:cuc888
Comment Utility
i've checked and it is not open for replay. i've looked at the queue and there is no large queue of unknown addresses. here is the header of one of the spam email. i can't tell where it is generated from.

Microsoft Mail Internet Headers Version 2.0
Received: from Robin ([172.30.6.1] RDNS failed) by mail.myserver.com with Microsoft SMTPSVC(6.0.3790.1830);
             Fri, 16 Jun 2006 06:31:51 -0700
Return-path: <firstname_lastname@myserver.com>
Received: from [142.135.192.72] (port=2710 helo=[142.135.192.72])
        by myserver.com with esmtp
        id 0ZKEf4-fZl291-83
        for firstname_lastname@myserver.com; Fri, 16 Jun 2006 08:01:51 -1000
Reply-To: Leanna <firstname_lastname@myserver.com>
Message-ID: <79158161.20060616080151@myserver.com>
From: Leanna <firstname_lastname@myserver.com>
To: <firstname@myserver.com>
Subject: Save your money, buy pills here!
Date: Fri, 16 Jun 2006 08:01:51 -1000
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_0068_01C4B064.95321943"
X-Priority: 1
X-Mailer: The Bat! (v3.71.14) Home
X-Spam: Not detected
X-OriginalArrivalTime: 16 Jun 2006 13:31:51.0734 (UTC) FILETIME=[39F07D60:01C69149]

------=_NextPart_000_0068_01C4B064.95321943
Content-Type: text/html;
        charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

------=_NextPart_000_0068_01C4B064.95321943
Content-Type: image/gif;
Content-ID: <pOwi8GK9DRX0$HrwYoTHz$AK1WehJLQ@nMpW>
Content-Transfer-Encoding: base64


------=_NextPart_000_0068_01C4B064.95321943--
0
 

Author Comment

by:cuc888
Comment Utility
is this where the email sent from?

Received: from [142.135.192.72] (port=2710 helo=[142.135.192.72])

i look at other headers of other spam emails and they are different on each one like this for example:
Received: from [81.229.108.74] (port=1758 helo=[81.229.108.74])

is this server problem or client?

0
 
LVL 104

Accepted Solution

by:
Sembee earned 250 total points
Comment Utility
The presence of Internet headers means the message came from outside.
The first IP (142.135...) is from Canada. The second (81.229...) is Sweden.

It looks like standard spam, with one of their standard methods of putting your domain in both the from and the to line.

The messages aren't coming off your machine, which means there is nothing you can do about them.
Your spam filter should be dealing with these types of messages.

Simon.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

"Migrate" an SMTP relay receive connector to a new server using info from an old server.
Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now