lots on email sitting in the queues

[waely]

Hi,
I noticed that our email has been slow sending emails. looked at the SMTP and I found lots of the queues that are waiting to be sent out. the status of these queues are Retry...

some of these queues have no emials in them but they're still there.

from looking at the queues I can tell that these emails are spam because they are not going to coming from anyone from our company plus I can pretty much tell from the subject line.

can someone help me determining whether someone is using our smtp server for spam?

we're using exchange server 2000

thanks

 

[Zelandakh]

You've detailed that emails are going OUT but you didn't send them. Someone must be using your server to resend spam.

Search this forum for RELAY and follow the instructions.

<signature for rent>

 

[waely]

I used few online tools to check for relay and most of them said that my STMP is maybe open for relay because one test out of seven succeeded to get through.

I checked my relay against MS documentation and my SMTP turned to be closed for relay. I still see lots of spam emails sitting in the queue. tried to delete most of them with NDR but they still arrive.

any ideas?

thanks

 

[Marcs41]

Turn OFF all NDRs to the internet.
What you did (enumerate) will give you the means to clear the queues, but it will not stop the spam of course.

To turn off NDR and others:
Open System Manager - Global Settings - Internet Message Formats - properties for the Default Recipient policy - Advanced.
Disable all 'Allow..' lines.

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!
How Do You Get Great Answers To my Tek-Tips Questions? [/sub]See faq222-2244

 

[waely]

thanks mark but I already have the NDRs turned off.

waely

 

[Marcs41]

Oh, because you said: "tried to delete most of them with NDR but they still arrive"

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!
How Do You Get Great Answers To my Tek-Tips Questions? [/sub]See faq222-2244

 

[waely]

my issue with spam emails is still outstanding. anyone has any different ideas??

thanks

 

[tadduci]

I had this same problem and I turned off the ndr's and other notifications to the internet, restarted the services (most people forget to do this) and my problem was resolved this way.

 

[waely]

I disabled the NDR long time ago and rebooted the system so many times. :-(

 

[Marcs41]

You better start checking WHERE those messages originate from, without that info you will get nowhere.

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!
How Do You Get Great Answers To my Tek-Tips Questions? [/sub]See faq222-2244

 

[waely]

they're coming from different IP addresses. I don't recognize the senders or the recipients.

thanks

 

[libroos]

Hi Waely,

Could the spam mails coming from end-users? Check the email Internet headers.

If need be, perform anti-virus scans on the systems, and install ad-aware or spysweeper on the workstations to sweep the systems. You should be able to capture some trojans.

Remember to purge the Internet Explorer cached files.

U can use Outlook express at the Server to see the emails and to check the headers.

You need to perform some tracing there.

Good luck.

Rgds
libroos

 

[Marcs41]

those things were already checked above, please read the entire thread before posting identical steps.

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!
How Do You Get Great Answers To my Tek-Tips Questions? [/sub]See faq222-2244

 

[waely]

thanks Libroos. the emails are going from unrecognized users to unrecognized recipients. I know it's spam...
I just ran adaware and spybot which cought lots of objects.
I'll monitor it and see that has any effect.

thanks

 

[Marcs41]

because they are not going to coming from anyone from our company

and

they're coming from different IP addresses. I don't recognize the senders or the recipients

But now you say you found traces with AdAware, that means it IS from your own domain!
Like I said before, you better check VERY good what is going on on your LAN, as I suspect you are looking in the wrong direction.

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!
How Do You Get Great Answers To my Tek-Tips Questions? [/sub]See faq222-2244

 

[waely]

I ran the adaware and spysweeper on my ISA machine. found few objects, not sure if they're related to my spam problem since the names don't mean anything. I will monitor it.
thanks Marc and I'll let you know.

 

[Marcs41]

You have serious problems my friend, if you already have spyware on the ISA server, I dare not imagine what the rest will look like.
The ISA server is supposed to secure things like that, so you really have to start wondering how on earth that could even get on there.
From everything I read, your security settings sound very leaky, very!

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!
How Do You Get Great Answers To my Tek-Tips Questions? [/sub]See faq222-2244

 

[waely]

I guess I have to reconfigure the ISA server. I just started in this company and still trying to clean things up.

where can I find the best settings for ISA server? is there any documentations regarding this?

thanks

 

[Marcs41]

Best place to start ...

http://support.microsoft.com/default.aspx?pr=ISAS

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!
How Do You Get Great Answers To my Tek-Tips Questions? [/sub]See faq222-2244