Spam using my SMTP, fills drive with bad emails

[timo85283]

My Win2K webserver has SP3 and all the pre-SP4 patches, but my Event viewer gets filled with the following events:

"Message delivery to the remote domain 'yahoo.co.kr' failed for the following reason: the remote server did not respond to a connection attempt."

The remote domain changes, sometimes appearing like a legitimate domain, but the messages are identical.

Furthermore, my inetpub/mailroot/queue and inetpub/mailroot/badmail folders get filled with junk emails from anonymous or bogus senders, so it looks like my SMTP is being used by an outside source to send spam.

I installed Symantec Antivirus Corporate Server Edition, but it found nothing on my server.

On the MS website, I found an old pre-SP3 article/patch (Q302755) that fixes a problem with SMTP authentication. I would think that because I have SP3 and all the pre-SP4 patches, this problem could not exist anymore, but when I checked the registry for the proof that this patch was installed, the registry key was missing. Hmmm. So I uninstalled all the hotfixes and SP3, then installed that Q302755 patch and verified in the registry that it installed OK, then I re-installed SP3 and all the pre-SP4 patches again and guess what?...the proof that Q302755 was installed is missing again from the registry. The spam is still coming, so now what can I do?

 

[GiaBetiu]

Ok, but in SMTP/Properties/Access what settings are you using? Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[timo85283]

Would you believe I haven't been there before? Now I feel really stupid. I found the checkbox that allows anonymous access--it was checked. (Can you tell someone else setup our internet stuff?) I'll monitor for a day or two and see if that helps. Thanks so much for the hint. --Tim

 

[LenLindquist]

Best check ORDB.org and see if you're listed as an open relay. If so, you can resubmit your site so they'll remove you.

Len