Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Spam through a specific user exchange 2003

Posted on 2012-03-19
2
Medium Priority
?
287 Views
Last Modified: 2012-03-23
So, I checked our Exchange 2003 mail queue this morning and saw that there were 4,019  spam emails sitting in the mail queue.  I turned up the logging settings for authentication and SMTP protocol. After reviewing the event logs I determined that that the spammers were authenticating through sales@mydomain.com. I disabled this account and there is no more spam entering the queue.  When I re-enable the account a large number of spam emails enter the mail queue every few minutes. I reset the password to this account thinking that that would eliminate the spammers ability to use it to authenticate but spam is still piling in.

I disabled the sales@mydomain.com account again and haven't seen any spam in the queue for a while now. How can I keep this account active without allowing the spammers to authenticate against it? I would think that changing the password would work but it doesn't. Any ideas?
0
Comment
Question by:David11011
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 2000 total points
ID: 37740047
After you have changed the password - you HAVE to restart the Simple Mail Transfer Protocol Service otherwise the spammers can still use the old username / password.

Once you have restarted the service, they will have to either work out the new password or find another account with a weak password to abuse.

Some useful reading for you from my blog:

http://alanhardisty.wordpress.com/2010/09/28/increase-in-frequency-of-security-alerts-on-servers-from-hackers-trying-brute-force-password-programs/

http://alanhardisty.wordpress.com/2010/12/01/increase-in-hacker-attempts-on-windows-exchange-servers-one-way-to-slow-them-down/

Alan
0
 
LVL 2

Author Closing Comment

by:David11011
ID: 37758125
Thanks Alan,
Restarting the SMTP server did the trick. I figured that the user authenticated against the domain controller every time it sends or receives an email. I guess I was wrong. You have to restart the SMTP service for password changes on the domain controller to take effect on the exchange server.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article lists the top 5 free OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their exchange server is no longer available or some other critical issue with exchange server or impor…
Check out this step-by-step guide for using the newly updated Experts Exchange mobile app—released on May 30.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question