Help with spam type email

[dpeno]

We are running a Exchange 5.5 server for email. Recently we have been bombarded with email that is undeliverable. An email address was comprimised ( from a web page scan, I think ) and we are now getting 200-300 undeliverable emails a day from this address with about 50 different address in the TO: field that do not exist. The emails have viruses on them that our email virus scanner is removing. I think someone is forging the good email address in an attempt to get a virus inside our company. None of the addresses in the TO: field exist but we would like to be able to stop them. Does anyone have any ideas?

Dave

 

[zbnet]

You're probably suffering from a 'reverse NDR' attack. You need a product like MailSweeper or XWall to sit between Exchange and the Internet, and drop any messages to invalid addresses - this is known as white listing.