Exchange Queue Question- SPAM/Virus?

24 Mar 2009 3:10 PM

Greg M

Hello,

On EXch 2003 running on SBS 2003 in the Queue there is always an SMTP
connector for yahoo.com and aol.com. In these quesues there are upwards on
100 messages where the sender is from another domain? Are spammers relaying
off this server? Relaying does not seems to be open. Or is the a virus
internalls?

Thoughts?

Thanks for any insights!!!

24 Mar 2009 3:20 PM

Mark Arnold [MVP]

On Tue, 24 Mar 2009 08:10:15 -0700, Greg M
<Gr***@discussions.microsoft.com> wrote:

>Hello,
>
>On EXch 2003 running on SBS 2003 in the Queue there is always an SMTP
>connector for yahoo.com and aol.com. In these quesues there are upwards on
>100 messages where the sender is from another domain? Are spammers relaying
>off this server? Relaying does not seems to be open. Or is the a virus
>internalls?
>
>Thoughts?
>
>Thanks for any insights!!!

It won't be relaying but will more than likely be NDRs trying to get
back to non-existent addresses or addresses that are over size or
similar.

24 Mar 2009 3:55 PM

Martin Blackstone [MVP]

Those are probably NDR's generated by spam to invalid addresses.
You might want to explore enabling recipient filtering on your Exchange
server.
That should help.

You might want to ask in the SBS groups about how to enable it. Sometimes
SBS methods are different from standard Exchange ones and I donâ€™t want to
give you bad "how to" info.

Show quoteHide quote

"Greg M" <Gr***@discussions.microsoft.com> wrote in message
news:1860380A-B500-4F7C-A95D-DB1B1998119B@microsoft.com...
> Hello,
>
> On EXch 2003 running on SBS 2003 in the Queue there is always an SMTP
> connector for yahoo.com and aol.com. In these quesues there are upwards on
> 100 messages where the sender is from another domain? Are spammers
> relaying
> off this server? Relaying does not seems to be open. Or is the a virus
> internalls?
>
> Thoughts?
>
> Thanks for any insights!!!

24 Mar 2009 5:02 PM

Greg M

ok thanks...

Show quoteHide quote

"Martin Blackstone [MVP]" wrote:

> Those are probably NDR's generated by spam to invalid addresses.
> You might want to explore enabling recipient filtering on your Exchange
> server.
> That should help.
>
> You might want to ask in the SBS groups about how to enable it. Sometimes
> SBS methods are different from standard Exchange ones and I donâ€™t want to
> give you bad "how to" info.
>
> "Greg M" <Gr***@discussions.microsoft.com> wrote in message
> news:1860380A-B500-4F7C-A95D-DB1B1998119B@microsoft.com...
> > Hello,
> >
> > On EXch 2003 running on SBS 2003 in the Queue there is always an SMTP
> > connector for yahoo.com and aol.com. In these quesues there are upwards on
> > 100 messages where the sender is from another domain? Are spammers
> > relaying
> > off this server? Relaying does not seems to be open. Or is the a virus
> > internalls?
> >
> > Thoughts?
> >
> > Thanks for any insights!!!
>
>

24 Mar 2009 5:12 PM

Greg M

IF they were NDR's wouldn't the "from" field be postmaster or
administra***@domain.com

instead the from field is random addresses from random domains?

Show quoteHide quote

"Martin Blackstone [MVP]" wrote:

> Those are probably NDR's generated by spam to invalid addresses.
> You might want to explore enabling recipient filtering on your Exchange
> server.
> That should help.
>
> You might want to ask in the SBS groups about how to enable it. Sometimes
> SBS methods are different from standard Exchange ones and I donâ€™t want to
> give you bad "how to" info.
>
> "Greg M" <Gr***@discussions.microsoft.com> wrote in message
> news:1860380A-B500-4F7C-A95D-DB1B1998119B@microsoft.com...
> > Hello,
> >
> > On EXch 2003 running on SBS 2003 in the Queue there is always an SMTP
> > connector for yahoo.com and aol.com. In these quesues there are upwards on
> > 100 messages where the sender is from another domain? Are spammers
> > relaying
> > off this server? Relaying does not seems to be open. Or is the a virus
> > internalls?
> >
> > Thoughts?
> >
> > Thanks for any insights!!!
>
>