-1

One of my users received a spam message from his internal exchange server on an SBS 2003 machine. The message apparently orginated from an unknown user from his own domain. (i.e. Chris@abc.com received a spam message from John@abc.com) However, john@abc.com does not exist and there is no mailbox for him. I checked and there are no open relays. What do I need to do to figure out how this happened and how to stop it? The message did show up in the message tracking center. With the following info:

9546270937.20111128072226@abc.com
SMTP:Message Submitted to Advanced Queuing
SMTP:Started Message Submission to Advanced Queue
SMTP:Message submitted to Categorizer
SMTP:Message Categorized and Queued for Routing
SMTP:Message Queued for Local Delivery
SMTP:Message delivered locally to chris@abc.com
SMTP:Store Driver: Message Delivered Locally to Store to chris@abc.com
Ward - Trying Codidact
  • 12,899
  • 28
  • 46
  • 59
Jeff
  • 1

1 Answers1

2

I would not spend a lot of time trying to trace it. And frankly, if it is the only one, then I would not spend any more time even worrying about it. The message certainly came from outside the domain, because if Exchange is not set to relay, and there is no john@abc.com, then the message did not originate on your server. Forging the from address is very common in spam. So you do not have to worry about a virus/bot infested computer.

If you must, then (as Ward noted in the comment), you need to examine the message headers to find the IP address of the original sending machine. I con't recall exactly how to see the headers in Exchange 2003, but it can be done.

If there is a more serious spam problem, better to crank up the anti-spam features than to try and find individual culprits.

As an aside .. it really is time to suck it up and upgrade Exchange.

tomjedrz
  • 5,974
  • 1
  • 16
  • 26