Software
Some users are getting spam but the sender is either themselves or someone else that is internal. Any ideas where this might be coming from and how to stop it? I am relaying and I am behind a content scanner. I would be forever grateful for any help.
Cam
by jgiroux
Kind of a long shot...but might want to check if your clients are running Win2k or XP Pro and they have virtual smtp server's open.
A virus or something bad on network could be taking advantage of them unkownly but sending to their smtp.
Goto admin tools | internet information services to verify this.
by [_rick_>
Check the SMTP header of those messages, this information will immediately tell you where the message originated from.
If it was internally generated (eiter by direct communication with the SMTP server - or no header since it was using Outlook mapi, then you probably are infected with a worm.
There were a number of worms that would impersonate a person, so check to make sure that none of your users have become infected with the KLEZ.? variety worm, or another self propagating worm.
Also be wary of some worms that come with their own SMTP code and attach to an outside SMTP server. May want to place strict outbound allowances on the firewall to only allow an Internally dedicated SMTP server to communicate out on port 25. This at least would help stop the Internal worm of propagating any more than it has already.
Good luck
Rick
by cevans
Thanks for the info I'll take a look post the outcome.
Cam
This discussion is closed to new replies.
Sort by Trending