Spamming FROM our Network!!!!!!! 1

[nelson97]

What's the best approach to combatting spams coming from our network. We have a mail server on our network and everyday throughout the day and night the mail server activity monitor reports numerous spams coming from our network internet bound to various email addresses e.g.: FROM <> TO user@domain.com.
Entering these addresses in my kill list is nearly futile, just keeps generating and getting worse. All my workstations are up-to-date on Norton and I've used programs like SpyBot to detect spywares.
Where do I even begin to effectively battle this?

Thank you

 

[cmeagan656]

Its not spam coming from your network. Its a reverse NDR attack. See faq10-5018

Cheers.

 

[nelson97]

I dont' have MSExchange, it's an FTGate mail server...

 

[Dollie]

Nelson, you're going to need to act quickly before your IP address makes the spam blocklists. You may want to check some of them to be sure you aren't already on them.

Check your mail server for standard users with weak passwords. Also, if your mail server is reporting the spams originating from your network, you should be able to examine the headers and see if they are pointing to a specific machine within your network.

If you were using Exchange I'd say to check for the SMTP AUTH hack.

Could you post munged headers for review?

 

[nelson97]

Thanks for the responses. cmeagan656, your info provided the direction I needed to research our problem on and verify were were suffering from NDR attacks. I went ahead and created a catch-all account and forwarded all emails to outlook which I've created a rule to delete messages not addressed to my catch all account, e.g. invalid email addresses. Thanks!