Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have noticed huge amounts of email going to random .com.tw domains. My Exchange event log its erroring with them every few seconds. I am wondering is it possible to see which computer this is coming from maybe its a virus? Has anyone had similar experience with this? Im running Small Bussiness Server 2003.

Thanks,

share|improve this question

4 Answers 4

up vote 4 down vote accepted

Are you running an Open Relay? If not then I believe you do have a virus. It's time to find the culprit, do that fast otherwise you'll get your domain blacklisted. Something like this happened to me a long time ago and it was I was running an open relay.

Run this site to see if you're running an Open Relay: http://www.checkor.com/

Check this thread for more info on the sending spam: http://serverfault.com/questions/10906/recommendations-for-handling-directory-harvesting-spam-on-exchange-2003

share|improve this answer
    
+1 for doing this fast, in fact, you might want to shutdown your email server. Other email servers will probably just add the emails to a queue to try to resend later so you won't loose incoming mail probably. Better down for a while than blacklisted!! –  Kyle Brandt Aug 3 '09 at 17:08
    
Clarifying what Kyle said: Other email servers will just add the emails to a queue to try to resend later, so you won't loose incoming mail. –  Carl Campos Aug 3 '09 at 18:20
    
The server did have an open relay, one of the other admins accidentaly opened it up when trying to resolve a different issue. we got that taken care of and we did indeed get blacklisted by Barracuda, we requested remove from the list. They were great at getting that taken care of. –  Grishanko Aug 8 '09 at 15:04
    
Glad to hear that you got it resolved and that Barracuda removed you without any issue. –  Hondalex Aug 10 '09 at 13:32

You should be able to turn up the SMTP logging using the Exchange console. It is on the Diagnostics tab, SMTP transport. Then you will have a log written to your Logs folder under your Windows directory for the SMTP service which should capture the SMTP conversation between the client and your exchange server leading you to the offending machine.

share|improve this answer

It is possible that this traffic is back-scatter. If incoming email is being addressed to "aabbccddeeeff@[yourdomain]", you'll get outbound mail destined to the listed MAIL FROM: address, as a delivery-status-notice gets sent informing them that no such user exists on your system. This is a form of directory-harvest attack that relies on an actual receiving mailbox to determine which addresses did NOT result in a DSN being sent and are therefore valid email addresses.

share|improve this answer

Are you running any type of AV on your mail server? What are some of the errors you are seeing, can you post a screenshot of them?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.