Virus sending phishing emails through exchange server

Posted by therulebookman on Server Fault See other posts from Server Fault or by therulebookman
Published on 2010-04-22T16:26:28Z Indexed on 2010/04/22 16:33 UTC
Read the original article Hit count: 376

Filed under:

exchange-2003

|

smtp-relay

|

virus

|

phishing

It appears that there is a virus on my network somewhere that is sending phishing emails through my exchange server. I can see the messages in message tracking and I see many SMTP errors for NDR's and rejected connections from external servers, but I do not see any SMTP authentications and I have logging up to MAX. How can I find the IP or hostname of the PC that is infected? Or is there some other explanation than virus?

Anti-virus scan on server is clean. Server is not an open relay.

Thanks

© Server Fault or respective owner

Related posts about exchange-2003

Migrating from "partial" Exchange 2003 to full Exchange 2003 usability

as seen on Server Fault - Search for 'Server Fault'
I have a client that is using Exchange 2003 on SBS 2003 R2, but only for calendar sharing and contacts sharing. Their email is still coming to their clients via a POP3 account on each client's Outlook. I'd like to move them over to using Exchange for both email and the other things they are utilizing… >>> More
Exchange 2003: Fresh install, couple noob questions.

as seen on Server Fault - Search for 'Server Fault'
Hi All, Thanks for reading! I have a small network set up for a local office here, and have a fresh install of Exchange 2003 on our sole-server PDC. The network uses one domain, call it ourdomain.net, which is DNSed locally, but not DNSed for the actual domain, so ourdomain.net works from within… >>> More
Upgrade Exchange 2003 to Exchange 2010 – Part II

as seen on Simple Talk - Search for 'Simple Talk'
In Jaap's second article on upgrading straight from Exchange Server 2003 to 2010, he explains how to move the various services from Exchange Server 2003 to Exchange Server 2010 and fully decommission the Exchange Server 2003 servers. >>> More
Export Message Tracking in Exchange 2003

as seen on Server Fault - Search for 'Server Fault'
Hello everybody How can to export message tracking from exchange 2003 for month with user >>> More
Exchange 2003 SP2 and Windows Server 2008 R2 Domain Controllers

as seen on Server Fault - Search for 'Server Fault'
I'm looking at adding two Windows Server 2008 R2 Domain Controllers into our Windows Server 2003 domain to support our Exchange 2003 SP2 server and replace a retiring Windows Server 2003 Server. Our Domain and Forest functional levels are currently Windows Server 2003, which supports domain controller… >>> More

Related posts about smtp-relay

Windows SMTP Relay Server to add BCC to all emails

as seen on Server Fault - Search for 'Server Fault'
I'm looking for a Windows based SMTP Relay Server which allows me to add a specific BCC field to all outgoing emails that relayed through this server. The reason for such requirement is that we need to track if the email is actually sent. We're sending our email to end users via our cooperate email… >>> More
.NET Mailserver smtp/relay problem

as seen on Server Fault - Search for 'Server Fault'
Question, I'm trying to setup my own mailserver: This is the server (latest version): http://www.codeproject.com/KB/vista/SMTP_POP3_IMAP_server.aspx Now I've the following problem: I can add user accounts, and receive mails from the internet in that account. I can also setup a mailinglist. This… >>> More
Postfix smtp relay

as seen on Server Fault - Search for 'Server Fault'
Hi there, I want to setup a second smtp server to receive emails when the primary server is down. The primary server is a configured by OS X Server, the secondary is a Postfix setup on Debian. The secondary is able to accept emails, but how to I push to the primary server? I need a little hint… >>> More
SMTP Relay through exchange

as seen on Server Fault - Search for 'Server Fault'
Hi guys, We have a bit of a problem in that we want our printers to email our contractor whenever they develop a fault. The problem is on our corporate network we have no access through the firewall to the internet preventing us to use the external SMTP server. So i suppose the question is can we… >>> More
Sendmail is refusing connection after configuring SMTP relay

as seen on Server Fault - Search for 'Server Fault'
I'm setting up sendmail on my home computer to use with my webserver. I've set it to use my SMTP server provided by my hosting company. If I use the following command, it works sendmail -Am -t -v and then I enter the to and from emails. But if I try the following, it does not work. sendmail… >>> More