Hey All,
Any useful idea (no, not I’m not implementing SendMail) would be welcome.
Characteristics of the duplicate email:
1) Repeats every hour or half hour for 30-96 hours
2) Affects a different set of 2-3 users at the same day and time AND domain (@newcastlegolf.com)
3) Email is formated either ASCII or ISO, never Windows or UTF.
4) Occurs almost every week
5) Has affected only 12 of 300 employees over the past two months
6) No email items in any Exchange queue
7) 99% of the time the duplicate is a REply or FWard
Environment:
Dell PowerEdge 2900 with Windows Server 2003 R2, SP2 with up to date security, and critical updates.
Exchange Server 2003 R2 (v6.5 SP2) – current patches
Outlook Web Access on the Exchange server
Outlook 2002 – 2007
Windows Terminal Server
Symantec Corporate Edition 10.x
Symantec Mail Security 6.x
Watchguard Firewall (X750e) with SpamBlocker
HP Procurve 2650 switches
What I’ve tried:
1) Patched Windows and Exchange
2) Ran integrity checks with ESEUTIL and ISINTEG
3) Disabled both Symantec products during an incident (didn’t stop the attack)
4) Disabled Anti-Intrusion firmware on the Watchguard
5) Verified the Exchange and Watchguard settings repeatedly
6) Every device and server has been rebooted
What I’ve eliminated:
1) Symantec – was Disabled, duplicates were still received
2) The exchange server queue – if it was the exchange server why sometimes repeat every half hour for some, every hour for most?
3) Watchguard Spamblocker – if it was the spam filter causing timeouts we’d see one or two duplicates…not NINETY-SIX.
Having elimintated everything, I am open to suggestions.
Best,
Pete Hansen
IS Manager
Oki Developments
