Email Virus - Exchange 2003 / Ironmail

Posted on 2009-04-22
Last Modified: 2013-11-22
I have a user that keeps receiving "undeliverable" or "mailbox does not exist" auto reply messages regarding emails she has not sent.  It appears to me that her machine has a virus and is sending out mass emails from her account.  Her computer has been checked thoroughly for a virus, and appears to be clean though.  We're using Exchange 2003, and Ironmail as our filter.  These outbound messages are being logged in Ironmail, so it appears that they are being generated and sent internally.  Any ideas on how to track this down?
Question by:GCIT_Manager
    LVL 65

    Accepted Solution

    Confirm it is coming from that workstation. Most bots will have their own SMTP engine, they will not use something else. The IP address would be on the log from your antispam filter.
    If it is coming off that machine then wipe it. I work on simple principle that once a bot gets on to the machine, it is no longer your machine.


    Author Comment

    Thank you Simon for your input.  I checked our logs, and Ironmail does not track the IP address of the user's machine.  It will only record the IP address of the mail server.  I checked with Ironmail support, and they verified that they do not track the user's IP address.  
    LVL 65

    Expert Comment

    BOTs send their email directly - they don't go through another server. Is the appliance set as your default gateway? Are you sure that it is the outbound email messages you are seeing in the logs?


    Author Comment

    No, Ironmail is not set as our default gateway, and yes the messages that I am looking at were all outbound.  There was a large ammount of outbound messages from her account between 4-6am, the morning that she received many of these bounce back messages.  She did not author any of those messages.  We are going to reformat her machine to see if that fixes it.  

    Author Closing Comment

    We took her workstation out of the equation and the problem appears to be resolved.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Wish Marketing would stop bothering you?

    Is your marketing department constantly asking for new email signature updates? Are they requesting a different design for every department? Do they need yet another banner added? Don’t let it get you down! There is an easy way to manage all of these requests...

    Email statistics and Mailbox database quotas You might have an interest in attaining information such as mailbox details, mailbox statistics and mailbox database details from Exchange server. At that point, knowing how to retrieve this information …
    You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
    In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
    The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    10 Experts available now in Live!

    Get 1:1 Help Now