Spam through a specific user exchange 2003

So, I checked our Exchange 2003 mail queue this morning and saw that there were 4,019  spam emails sitting in the mail queue.  I turned up the logging settings for authentication and SMTP protocol. After reviewing the event logs I determined that that the spammers were authenticating through sales@mydomain.com. I disabled this account and there is no more spam entering the queue.  When I re-enable the account a large number of spam emails enter the mail queue every few minutes. I reset the password to this account thinking that that would eliminate the spammers ability to use it to authenticate but spam is still piling in.

I disabled the sales@mydomain.com account again and haven't seen any spam in the queue for a while now. How can I keep this account active without allowing the spammers to authenticate against it? I would think that changing the password would work but it doesn't. Any ideas?
LVL 2
David11011Asked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
Alan HardistyConnect With a Mentor Co-OwnerCommented:
After you have changed the password - you HAVE to restart the Simple Mail Transfer Protocol Service otherwise the spammers can still use the old username / password.

Once you have restarted the service, they will have to either work out the new password or find another account with a weak password to abuse.

Some useful reading for you from my blog:

http://alanhardisty.wordpress.com/2010/09/28/increase-in-frequency-of-security-alerts-on-servers-from-hackers-trying-brute-force-password-programs/

http://alanhardisty.wordpress.com/2010/12/01/increase-in-hacker-attempts-on-windows-exchange-servers-one-way-to-slow-them-down/

Alan
0
 
David11011Author Commented:
Thanks Alan,
Restarting the SMTP server did the trick. I figured that the user authenticated against the domain controller every time it sends or receives an email. I guess I was wrong. You have to restart the SMTP service for password changes on the domain controller to take effect on the exchange server.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.