Spam Bots

[Kyajae]

Guys,

Has anyone any experience of Spam Bots sending cr@p out from a network via Exchange Server. This isn't a 'for sure' problem I'm looking into but I've got some strange emails heading out in the form of [garbled-mix of alphanumenrics]@our-domain-name.co.uk which looks like the classic generated spam we all come across.

Does anyone know of any software we can deploy to determine if we have a hijacked PC/Server?

Thanks.

[DaveB]

Guys,

Has anyone any experience of Spam Bots sending cr@p out from a network via Exchange Server. This isn't a 'for sure' problem I'm looking into but I've got some strange emails heading out in the form of [garbled-mix of alphanumenrics]@our-domain-name.co.uk which looks like the classic generated spam we all come across.

Does anyone know of any software we can deploy to determine if we have a hijacked PC/Server?

Thanks.

You have turned of mail forwarding on the server, havn't you?

When you say you have strange emails heading out where are you seing them? Are they being bounced as undeliverable or can you see them in the mail transaction logs?

It's probably not the server that has the problem but a compromised PC on the network. Check the mail server log for traffic and see if there is a culprit. If you arn't logging traffic atm start and see what turns up.

Do the destination addresses have a pattern? Are they all sent from the same "from" address?

If this fails run a sniffer like windump/tcpdump and look for traffic on port 25, might give you the IP off the offending box including traffic coming from outside and being bounced off your mail server.

[spoons]

Is your Exchange server external facing, or do you have another host/service inbetween that and the internet?

As mentioned it is worth checking your relay settings on the Frontend servers, to ensure that the server is not acting as an open relay.

[Clippy]

This may help