mail being returned that no one is sending

[tommishuck]

Just a quick background-
I have limited exchange experience, but my boss quite, and until we hire a replacement, I am the CIO/Network admin as well as my helpdesk and PC duties.

We have a group on our e-mail account "_admin" and this group does have a e-mail address of admin@abc.com (I changed the domain to abc, to protect our company). Within the past 1 1/2 weeks, we have been getting the below message sent to everyone that is a member of the group. No one has claimed to have sent a message out under this address, but regardless, I want to stop these from coming back through our exchange server.

This is just one of about 4 different e-mails that we are receiving.



Message from yahoo.com.
Unable to deliver message to the following address(es).

<root@yahoo.com>:
This address no longer accepts mail.

<admin@yahoo.com>:
This address no longer accepts mail.

--- Original message follows.

Return-Path: <admin@abc.com>

The original message is over 5k. Message truncated to 1K.

X-Rocket-Spam: 71.3.97.189
X-YahooFilteredBulk: 71.3.97.189
X-Rocket-Track: cat=BK; info=ip:BK<ip=71.3.97.189,policy=g-w0,n0,g100>;sv:UK<ip=206.190.53.246>
X-Originating-IP: [71.3.97.189]
Return-Path: <admin@abc.com>
Authentication-Results: mta131.mail.re2.yahoo.com
from=abc.com; domainkeys=neutral (no sig)
Received: from 71.3.97.189 (HELO cnylhfl.com) (71.3.97.189)
by mta131.mail.re2.yahoo.com with SMTP; Tue, 29 Nov 2005 16:28:30 -0800
From: Admin@abc.com
Date: Wed, 30 Nov 2005 00:27:30 UTC
Subject: Registration_Confirmation
Importance: Normal
X-Priority: 3 (Normal)
Message-ID: <c8b169cc.d6573c7f4d@bridgewaycounseling.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="==3c8df3bdaa392.0da8ea528"
Content-Transfer-Encoding: 7bit
This is a multi-part message in MIME format.

--==3c8df3bdaa392.0da8ea528

Account and Password Information are attached!


***** Go to:

http://www.abc.com

***** Email: postman@abc.com
--==3c8df3bdaa392.0da8ea528
Content-Type: application/octet-stream; name=reg_pass-data.zip
Content-Transfer-Encoding: base64
Content
*** MESSAGE TRUNCATED ***


If you can provide me with information on how to stop this from being sent to all members of the "_admin" group, I would be very appreciative.

Thanks,
Tom

 

[zbnet]

This sounds like you are the hapless victim of a spoofed email, probably being sent from someone else's comouter (ie not even on your network) to somewhere else on the Internet, but pretending to be from the email address of your DL - lots of viruses do this silently. The receiving system NDRs it, and you get the NDR back - or rather, all the members of this group do.

There's little you can do about viruses and spoofers out on the Internet. You could change the SMTP address of your DL, though, which should cure the immediate problem.

 

[tommishuck]

thanks for the info. so to change that all I would need to do is go to Active directory, right click that group, go to prop's then go the e-mail address tab, then under the SMTP type, change that e-mail address? Please let me know if I have this correct. We are running server 2000 and exchange 5.5.
Thanks!

 

[zbnet]

In 5.5 (with an ADC?) I'd change the SMTP proxy of a DL using Exchange Admin. But yes, you've got the principle.