[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Exchange 2003 Sending Spam and IP Blocked

Posted on 2014-01-15
10
Medium Priority
?
387 Views
Last Modified: 2014-01-15
Hi,

I have a issue with a Exchange 2003 server, for the last 2 x days it keeps getting black listed by spamhaus as something is sending spam out, we have checked Anti Virus and all seems ok, any ideas where to start ?

Regards
0
Comment
Question by:ComexIT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39783690
My article is a good place to start and should hopefully help you nail the problem quickly so you can get off the blacklists and get your mail flowing again:

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_2556-Why-are-my-outbound-queues-filling-up-with-mail-I-didn't-send.html

Any questions, please ask.

Alan
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39783692
First - are you sure that it is Exchange?
If you look in the queues you will see messages hanging around if the server is being abused, because spammer's lists are not very clean.
If the queues are clean, then the source isn't Exchange.

The next step is to simply block SMTP traffic on the firewall except from the Exchange server. Turn on logging and wait. A compromised workstation will soon appear on the logs and can be found and removed.

If you do have messages in the queues on the Exchange server, it is unlikely to be malware, just a compromised account being used to send out spam.

Simon.
0
 

Author Comment

by:ComexIT
ID: 39783700
Thanks Simon, do you have a list of steps for me to check etc ?

Thanks
0
Survive A High-Traffic Event with Percona

Your application or website rely on your database to deliver information about products and services to your customers. You can’t afford to have your database lose performance, lose availability or become unresponsive – even for just a few minutes.

 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39783709
Try reading my article - link above.

Alan
0
 

Author Comment

by:ComexIT
ID: 39783748
Thanks Alan,

I think its the ndr version as it shows from postmaster@domain etc, I have applied the filter etc, Do i need to clear the ques ?
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39783774
You should do - it will be NDR's going back to invalid addresses, and you don't want to hit any more blacklists sites and get blacklisted.

Are you on Backscatterer.org?

Alan
0
 

Author Comment

by:ComexIT
ID: 39783789
it says not listed but was before etc
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39783797
Good - let's hope you stay that way.

Have you resolved the Recipient Filtering yet so it doesn't happen again?

Alan
0
 

Author Comment

by:ComexIT
ID: 39783807
yes i have enabled the receip filter etc so that should now be ok, why does it happen .... it's a real pain, we thought it was a pc in network etc
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 2000 total points
ID: 39783822
Spammers having fun!  God knows why, but they like to see if they can send their crap out and bombard servers with all manner of rubbish in the hope that one or two make it through and as a result of you not filtering the recipient, the server has to send back NDR's and as the sender addresses are spoofed, some of the NDR's hit unpublished email addresses specifically designed to catch spam and you got caught not filtering invalid recipients.

Hopefully you don't get caught by the other option in my article as that can be very messy and a bit harder to isolate.

Alan
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I don't pretend to be an expert at this, but I have found a few things that are useful. I hope that sharing them here will help others, so they will not have to face some rather hard choices. Since I felt this to be a topic of enough importance and…
With so many activities to perform, Exchange administrators are always busy in organizations. If everything, including Exchange Servers, Outlook clients, and Office 365 accounts work without any issues, they can sit and relax. But unfortunately, it…
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question