Networks

Ask something
Question Locked

exchange server and spamming

0 helpful
9 replies

by exs2

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Ok after some days of running again we have the same thing:
Under SMTP Virtual Server Queues there is a yahoo.com.tw Queue with thousands of mails waiting to be delivered, prolly spams.
I would really like to know if there was a way to prevent all that spam without a 3rd party software involved. I tried to change my connection properties under Default SMTP Virtual Server - properties - connection , and i prohibited access to the specified IP BUT THEY KEEP COMING. I also noticed that when I Denied access to that ip, another hundred of Queues started from something like: msa32.hinet.com ms77.hinet.com ms45.hinet.com etc etc... enumerating some msgs from a random hinet.com queue i noticed that the recipients list was full of @yahoo.com.tw... Some of all those msgs are frozen and some of them have a failure delivery range of 10 ro 80 tries....
Checking a whois output hinet.com is an ISP provider at TW.
Could you please help me to avoid all that spam once and for all please ?!
How can i block them without blocking usefull mails too ? if i deny access to hinet.com it will reject even good mails from coming to our server too.... But the Queues like the msa32.hinet.com msa57 msa72 etc etc seem like there are several hosts sending all these who just connect to their isp... I dont want to ban whole hinet.com cause we do get EXPECTED emails from japan taiwan china. But I cant figure out what that is.
I really can't figure out why SMTP virtual server still puts my denied list of IP E-mail Senders to Queues.

9 replies

by oh smeg

When you say

[i]Queue with thousands of mails waiting to be delivered, prolly spams.[/i]

I'm assuming that these are outgoing E-Mails to unknown parties. And when you say that

[i] I also noticed that when I Denied access to that ip, another hundred of Queues started from something like: msa32.hinet.com ms77.hinet.com ms45.hinet.com etc etc... enumerating some msgs from a random hinet.com queue i noticed that the recipients list was full of @yahoo.com.tw... Some of all those msgs are frozen and some of them have a failure delivery range of 10 ro 80 tries....
Checking a whois output hinet.com is an ISP provider at TW.[/i]

It's not clear if these are inbound tot he Exchange Server or outbound from the Exchange server.

If they are all outgoing E-Mail which is what I would expect on one computer on your Network you have an Infection and if it is a nasty one when you kill it it will spread to other computers on the LAN and continue to send mail.

You need to isolate the Infected Computer to begin with and clean it up while at the same time monitoring the remainder of the LAN to make sure that no other computer starts to send out in these numbers. If they do you need to strip every computer rebuild and keep them disconnected from the Internet & LAN till they are all clean.

I've only seen this previously when someone has stopped the AV Service to install & play a game on the Internal LAN and this has resulted the the infection of every Computer
on the LAN. The AV product Appears to be working when it actually isn't and it is very hard to track down & repair.

Col

by normh3

His description sounds like OUTBOUND email too me.

by exs2

Ok. Let me try to illuminate you a bit more with some details I managed to check at my Exchange system manager.
From my Exchange System Manager following the route Administrative Groups > Servers > EXCHSRV > Protocols > SMTP > Default SMTP Virtual Server > Queues I can find my standard Queue Slots Like: Local Delivery Directory lookup Waiting to be rooted which are fine and working as intended with no Queue records and in ready state.
The problem is with other Queues that look like the following Format: Convex - yahoo.com.tw (SMTP Connector - Remote Delivery) , Convex - msa.hinet.com (SMTP Connector - Remote Delivery) etc etc. Those kinds of Queue Folders contain a lot of Queues with msgs some of them Frozen and some of them not.those Queues contain msgs and most of the time they are on a retry state.
Enumerating some of those msgs I can read that time of submission and and time recieved by server are both identical for all of the enumerated msgs.
Browsing one of the msg is where i get troubled figuring out if this is outbound or inbound transmission because:
in the MessageID field there is a string like that: <5ad3ce4e9aed4d398882be2f76040071@322b8932bcbe466fb43b4d5a842cf3fe>
proceeding to the Sent from field there is also a string like =?utf-8?B?IGNhbmNvbGxlZ2V+546p6Iap5Y+jMeWwjTHll44/ICAgIElaU0M=?= followed by an actual email address like which doesnt belong to our LAN (this is why I assume those are inbount broadcasts) and proceeding to the next fields i can read number of envelop recipients "number" and Envelop recipients SMTP:aaaaaa785@yahoo.com.tw; SMTP:jasony_2@yahoo.com.tw;
and changing to the details Form i can read Time of Submission and Time Recieved by Server BOTH IDENTICAL ALWAYS delivery failures "random number" and status "retry".
Those are 90% of the cases.
In most of those msgs I meet this address > following the string i posted above on the Sent from field which is why I am totally confused WHY would this be an outbound connection if i cn read a "rogue" sender on that field.
PLEASE help me identify a solution and MOST OF ALL please tell me are all those outbound or inbound Connections ?

by exs2

Ok some updates about my problem. I tried to Disconnect my email server from the network to make sure clients and exchange server do not communicate at all. Then, I connected Exchange Server directly to our gateway (router) and disconnected the remaining network from the gateway. I brought virtual Server DOWN cleared the Queue folder Bad Mail folder and terminated all sessions that were active. I rebooted the machine and restarted my SMTP Virtual server without any Queues or sessions. After 2 mins or less same thing happened: 2 Sessions established and the Queques started growing immense once more.
I came to the conclusion that even without any clients connected with the mail server I still experience the same problem and that means that somebody somehow uses me as a Relay to spam around, and that means that whatever is the problem (be it a virus or whatever), ALSO resides on the mail server TOO (if not only).
I am so frustrated about this, please help me if you can.

by oh smeg

I think you'll find that one of the Internal Computers has been taken over and is now a Zombie. It's making a large list of Mails to send out for it's new owner and has turned your LAN into a Spam Point.

You need to scan clean and fix the afflicted system and at the same time make sure that none of the others are infected.

I told you about this above. :)

Col

by exs2

thank you so much for your reply. It also seems like an outbound broadcast to me too.
Sorry for the topic abuse but is there ANY way to trace the local IP that tries to send all these mails?

This discussion is closed to new replies.