?
Solved

mailware

Posted on 2006-07-06
5
Medium Priority
?
241 Views
Last Modified: 2010-03-06
Hi all,

From time to time I am receiving emails which look like they were send from one of my users but I know that they didn’t send it.

--------------------------------------------------------------------------------------------------------------------------

-----Original Message-----
From: user1@mydomain.com
Sent: Thursday, 6 July 2006 10:33 a.m.
To: user1@mydomain.com
Cc: user2@mydomain.com; user3@mydomain.com
Subject: Diploma that you already earned!


Academic Qualifications available from prestigious NON-ACCREDITED universities.

Do you have the knowledge and the experience but lack the
qualifications?

Are you getting turned down time and time again for the job of your
dreams because you just don't have the right letters after your name?

Get the prestige that you deserve today!

Move ahead in your career today!

CALL +1-650-456-2500

Bachelors, Masters and PhD's available in your field!

No examinations! No classes! No textbooks!

Call to register and receive your qualifications within days!

24 hours a day 7 days a week!

Confidentiality assured!

+1-650-456-2500
--------------------------------------------------------------------------------------
im running windows 2003 SP1, and Exchange 2003 SP2.

I did a relay test on www.dnsreport.com and it says that i pass relay test and im not an open relay. i also did a telnet test for open relay with a positive result. so how come im getting those emails.

Any idea how can i track it and prevent my exchange?
0
Comment
Question by:aucklandnz
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
5 Comments
 
LVL 14

Expert Comment

by:ECNSSMT
ID: 17055923
at least you got the tamed ones..

If you look at the internet headers located at

View > Options > Internet Headers

you will see the source; if you got the same ones a few of my users did a couple of weeks ago from external associates; they were actually sent by those stated addresses (unbeknownst to the users themselves);   Our SMTP logs showed that.  I think our anti-virus app (Antigen) on Exchange may have stripped the payload off as there were no reports of my users being the source of these messages to other recipients (internal or external)

Otherwise; you may want to insure that the email server's anti-virus product is up to date; you don't allow attachements that are executable; VBS, JS, or anything that could be launched when the user open a message.

Spam guardwise; anti-spam product that can block messages from questionable sites/blacklisted sites

Regards,
0
 
LVL 3

Author Comment

by:aucklandnz
ID: 17055941
i forgot to mantioned that i run a mailmarshal software aswell
0
 
LVL 14

Accepted Solution

by:
ECNSSMT earned 2000 total points
ID: 17062982
the mailmarshall app looks like its all encompassing so between maintaining the blacklist and whitelist; it appears to be context based also.

The war on spam is a constant and active process; it looks like the mailmarshal may be able to permit the manual addition of strings to look for;

add the phrase "Diploma that you already earned!" to be blocked; if you are able to do so, it will solve your problem.  

We use a product from Tumbleweed to do the exact same thing and we do periodically manually update the filtering engine with phrases to filter out.

Regards
0

Featured Post

Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains how to install and use the NTBackup utility that comes with Windows Server.
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question