Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my users received a spam message from his internal exchange server on an SBS 2003 machine. The message apparently orginated from an unknown user from his own domain. (i.e. Chris@abc.com received a spam message from John@abc.com) However, john@abc.com does not exist and there is no mailbox for him. I checked and there are no open relays. What do I need to do to figure out how this happened and how to stop it? The message did show up in the message tracking center. With the following info:

9546270937.20111128072226@abc.com
SMTP:Message Submitted to Advanced Queuing
SMTP:Started Message Submission to Advanced Queue
SMTP:Message submitted to Categorizer
SMTP:Message Categorized and Queued for Routing
SMTP:Message Queued for Local Delivery
SMTP:Message delivered locally to chris@abc.com
SMTP:Store Driver: Message Delivered Locally to Store to chris@abc.com
share|improve this question
    
You'd have to post the message, including all headers. –  Ward Nov 30 '11 at 4:32
add comment

1 Answer

I would not spend a lot of time trying to trace it. And frankly, if it is the only one, then I would not spend any more time even worrying about it. The message certainly came from outside the domain, because if Exchange is not set to relay, and there is no john@abc.com, then the message did not originate on your server. Forging the from address is very common in spam. So you do not have to worry about a virus/bot infested computer.

If you must, then (as Ward noted in the comment), you need to examine the message headers to find the IP address of the original sending machine. I con't recall exactly how to see the headers in Exchange 2003, but it can be done.

If there is a more serious spam problem, better to crank up the anti-spam features than to try and find individual culprits.

As an aside .. it really is time to suck it up and upgrade Exchange.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.