How to see where email is coming from

[rubiconx]

I'm having an issue where emails are being sent via our exchange server that show up in the outbound queue as having '<>' as the originating source.

These are all dealing with the latest sober worm, but all on site computers are clean. How can I tell where these messages are being sent from (ie: make sure they aren't being sent on site) and how can I make it so that our server isn't sending out mail other than our own? Thanks in advance.

 

[zbnet]

Reverse NDR attack - faq10-5018

 

[Trixx]

I beleve the current rash of W32/Sober@MM!M681 messages is causing our mail server to collapse under the strain of 3000 messages in/out every day. I checked the Microsoft KB article id=837794 referred to. It seemed relevant, so I phoned Microsoft. They want £199 for the hotfix and there's still no guarantee this will fix our current problems.

 

[zbnet]

You should never be charged for a hotfix - they might initially need a credit card number to open the call, but if they charge you up front, and the call eventually gets settled by a hotfix, they should then refund the call charge.