Virus?

I think you just got added to the spammers’ lists. You could certainly block email from any hotmail account, but that would block legitimate ones as well.

One thing you could do is report it to Microsoft at abuse@hotmail.com.

See these links:

http://www.wown.com/j_helmig/mailspam.htm

http://news.com.com/2100-1033-210907.html?legacy=cnet

http://spam.abuse.net/goodsites/#aol

REMOVE SPACES from the pasted URLs

I really liked the links that Maxwell gave. I didn't see this one from Sunbelt Software, though. It's fairly new and being offered for $19.95 right now. "IHateSpam"

http://www.sunbelt-software.com/product.cfm?id=930

(no spaces in URL)

BTW, Sunbelt software has great newsletters!! Win2K News and WinXP News. Comes once a week.
HTH

Let's think this through. If these "rogue emails" are in your "outbound" queue, then they can only originate from one of two possible places. I am speaking in generalities, of course, when I say only one of two possible places - inside the organization or outside the organization.

The first place they can originate is from outside your organization. If this is the case, then you have open relay enabled, allowing any spammer to use your Exchange server as a hop. You stated, however, that you have closed that relay (disabled open relay).

The second place they can originate is from inside your organization. If that is the case then you have a perverted "farmer Jones" working for you.

There is another possibility, I suppose. But it'sonly possible if your server can indeed be used by outside spammers while you have open relay disabled. Exchange versions up through 5.0 are vulnerable to relay if they permit any local SMTP users. However, starting with version 5.5 (which you have), provisions have been made to prevent unauthorized relay.

http://mail-abuse.org/tsi/ar-fix.html

So I would suggest that you start looking for your perverted farmer, or double check yourself and make sure you have disabled your open relay.

Look at this Exchange 2000 article titled, “Is Your Exchange Server Relay-Secure?”

http://www.exchangeadmin.com/Articles/Index.cfm?ArticleID=7696

I hope you find something in that article that will pinpoint something that was overlooked while disabling open relay. (Otherwise, start looking for your farmer.)

In addition, this article titled, “Spam Source Tracking”, may prove useful as well.

http://email.about.com/cs/spamtracking/

REMOVE SPACES from the pasted URLs.

Good luck,

Maxwell

I’ve not heard of a virus with the characteristics that you described. (But that doesn’t mean it couldn’t happen.) I’m still guessing that there is some small detail that was overlooked while configuring your Exchange server.

The following are some excerpts from the article I mentioned. It does indeed describe more than simply disabling the open relay.

Exchange Server 5.5, has the tools to implement anti-spam recommendations and prevent the unauthorized use of yourresources. To maximize your ability to use these capabilities and configure your system's anti-relay defenses, you need to be running SP2 or later and the encapsulated relaying hotfix. An alternative to installing the hotfix is to install SP3, whichincludes the hotfix. In Exchange Server 5.5 before SP2, you could block relaying only by manually editing the Registry.

As Screen 1 shows (see article), two options on the Routing tab of the Internet Mail Service Properties sheet—Do not reroute incoming SMTP mail and Reroute incoming SMTP mail (required for POP3/IMAP4 support)—control mail relaying. The obvious choice seems to be Do not reroute incoming SMTP mail, but this option has several drawbacks, including that it isn't as secure as it might seem. Selecting this option prevents the IMS from relaying messages, but the IMS still accepts the messages and then generates a nondelivery report (NDR) that specifies that the recipient's address doesn't exist on the system.

This configuration doesn't meet the second RFC recommendation because it results in an error code that indicates success and generates an incorrect delivery failure report.

If your server is running in the Do not reroute incoming SMTP mail configuration, the IMS still may accept messages, and could allow your system to be the origin of reverse UCE (unsolicited commercial email).

(continued..)

The messages with a blank <> originator are non-delivery reports. The most likley cause for these NDRS is spam, addressed to non-existant user accounts (mailboxes) in your domain. It isn't a virus and it isn't because you're relaying mail. You're simply being targeted with spam, like every other system that's connected to the Internet. The return address on the spam is either bogus, or the hotmail account fills up with all the NDR's quickly so that it rejects the NDR. So, the NDR sits in your outbound queue until it times out.

As for preventing this, there are a few things you can do to reduce this unwanted traffic. If you can block the hotmail domain through Message Filtering, that could help. You would block legit e-mail from hotmail as well, though, so that's not likely a solution for you. Another possiblity is to get some kind of content filtering software, that can work to eliminate or reduce spam. It would be a third-party add-on, not free in other words.