Exchange 2003 external recipients causing blacklist issues

Question

Over the past few days our Exchange 2003 Small Business Server has been building up outgoing mail. I found out that we have been blacklisted by numerous email lists. In our queues there is about 500,000 messages of which most are some sort of spam. The number in the queue is still growing with more spam.

How do I go about either blocking or correcting the issue where an outside user is sending spam through our email server?

Answer 1

From the Exchange server open the following link. This will check if the server is open relay. If it found as open relay perform the following. Now, check the Exchange server's service pack version and let me know.

Answer 2

Steps in order and importance:

1. Stop the Exchange Server. Now, as soon as possible!
2. Change passwords from all users and all service accounts that are allowed to use Exchange
3. Shutdown all applications that use the Exchange Server as outgoing server
4. Configure Exchange to not sending any outgoing mail (could also be done by a firewall)
5. Start the Exchange again
6. Clean the queue from Spam
7. Check what Vick Vega suggested and act accordingly
8. Observe the queue if it fills up again; correct that if it does. Repeat this step until the queue remains clean from Spam (legit mail is allowed to fill up). Then proceed
9. Rollback the changes from step 4. Wait for the queue being empty.
10. Start applications from step 3 one by one. Watch the queue and logs for suspicious activity. If suspicious activity is observed then correct the application. Repeat and continue.
11. Give out the new passwords to the users
12. Observe the queue and logs and identify the person who (if) injects Spam. Punish this user

Then your server is clean again. Probably. A virus/trojan scan on the server is mandatory!! Don't skip a step or ignore the suggestions. Even if you think you can't afford the Exchange or other application to be down: This is an emergency and has to be done that way.