Solved

Exchange 2003 sending bogus emails

Posted on 2011-09-20
3
289 Views
Last Modified: 2012-05-12
What is the best way to troubleshoot my Exchange 2003 server that is sending out a TON of bogus emails?  I have enabled message tracking and it looks like something is having a great time. :(  Any help to troubleshoot and narrow this down would be great.  I have run an AV scan on the server and came back clean.
0
Comment
Question by:JJMarquart
  • 2
3 Comments
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 500 total points
ID: 36570886
0
 

Author Comment

by:JJMarquart
ID: 36571191
Awesome!  I think I am on the right track.  I have added the sender and recipient filtering and enabled the filter on the virtual SMTP server.  My event log is still recording alot of stuff outlined below.  I disabled the account I found in event viewer that was authenticating and sending email.  Any other tips on the info below would be awesome!

taurshen@ms16.hinet.net      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      ping6677g@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      intermet.tw@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      sugar_honey0913@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      ginny19900505@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      uendy29@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      yiling2247@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      e8229540@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      joanna910818@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      xyzmocha@yahoo.com.tw      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -
2011-9-21      2:1:27 GMT      99.159.239.145      vibwzh.com      -      SERVER      192.168.2.10      qkmjy1oqwde3kx@ms10.hinet.net      1030      a7d7b9ab5b004890b42a175c4bbe96a5@cb9c60fb073e420f9d6b9ffe40886c30      3      0      2774      11      2011-9-14 12:31:22 GMT      0      Version: 6.0.3790.4675      -       =?BIG5?B?WWFob28hqV+8r6nnveYgsN3DRKFHam5lZGliLHByanl6bg==?=      ofkef@pfld.com      -

2011-9-21      2:1:27 GMT      -      -      -      SERVER      -      ugeqz@yahoo.com.tw      1025      I9IJsaJbq00009145@ourdomain.com      0      0      4876      1      -      0      Version: 6.0.3790.4675      -      Delivery Status Notification (Failure)      postmaster@ourdomain.com      -

2011-9-21      2:1:27 GMT      -      -      -      SERVER      -      ugeqz@yahoo.com.tw      1025      9RQAOCop300007e42@ourdomain.com      0      0      5480      1      -      0      Version: 6.0.3790.4675      -      Delivery Status Notification (Failure)      postmaster@ourdomain.com      -

2011-9-21      2:1:27 GMT      -      -      -      SERVER      -      ugeqz@yahoo.com.tw      1024
0
 

Author Closing Comment

by:JJMarquart
ID: 36588161
NM got it.  Just had to clear out the que.  Thanks!
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

MS Outlook is a world-class email client application that is mainly used for e-communication globally.  In this article, we will discuss the basic idea about MS Outlook, its advanced features, and types of MS Outlook File formats.
Find out what you should include to make the best professional email signature for your organization.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question