Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Over the past few days our Exchange 2003 Small Business Server has been building up outgoing mail. I found out that we have been blacklisted by numerous email lists. In our queues there is about 500,000 messages of which most are some sort of spam. The number in the queue is still growing with more spam.

How do I go about either blocking or correcting the issue where an outside user is sending spam through our email server?

share|improve this question

2 Answers 2

From the Exchange server open the following link. This will check if the server is open relay. If it found as open relay perform the following. Now, check the Exchange server's service pack version and let me know.

share|improve this answer
    
Id add to that, that once you've stopped your server being an open relay, you then have an enjoyable task of asking all those blacklists to remove you, which is going to take some time. –  Sam Jan 13 '12 at 7:41

Steps in order and importance:

  1. Stop the Exchange Server. Now, as soon as possible!
  2. Change passwords from all users and all service accounts that are allowed to use Exchange
  3. Shutdown all applications that use the Exchange Server as outgoing server
  4. Configure Exchange to not sending any outgoing mail (could also be done by a firewall)
  5. Start the Exchange again
  6. Clean the queue from Spam
  7. Check what Vick Vega suggested and act accordingly
  8. Observe the queue if it fills up again; correct that if it does. Repeat this step until the queue remains clean from Spam (legit mail is allowed to fill up). Then proceed
  9. Rollback the changes from step 4. Wait for the queue being empty.
  10. Start applications from step 3 one by one. Watch the queue and logs for suspicious activity. If suspicious activity is observed then correct the application. Repeat and continue.
  11. Give out the new passwords to the users
  12. Observe the queue and logs and identify the person who (if) injects Spam. Punish this user

Then your server is clean again. Probably. A virus/trojan scan on the server is mandatory!! Don't skip a step or ignore the suggestions. Even if you think you can't afford the Exchange or other application to be down: This is an emergency and has to be done that way.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.