Thanks... I'll have to look into that. 'Preciate it. -----Original Message----- From: Dean Cunningham [mailto:[EMAIL PROTECTED] Sent: Thursday, June 09, 2005 12:17 AM To: Exchange Discussions Subject: RE: Another question
So your sure the exchange server is routing the spam *out* of the organisation? Stop the IMC and see what builds up in the queues. If you have spam building up in the queues , that would indicate a MAPI Spam client on a PC. If it stops , then it is a SMTP spam client on a compromised PC. I have not use 5.5 for some time, but IIRC , you should be able to up the logging on the IMC into the event log (need to restart the IMC if you up change the logging) The event log would then show the SMTP clients connecting to it and that should enable you to identify local clients that should not be connecting to it HTH Dean > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > John Aldrich > Sent: Wednesday, June 08, 2005 1:15 PM > To: Exchange Discussions > Subject: Another question > > We have two Exchange 5.5 servers. They are *supposedly* protected by > some sort of a pre-filter (we do seem to be blocking emails from > sources which don't match up the RDNS.) However, one of the mail > servers seems to be routing a LOT of spam. On the other hand, it's not > an open relay, as I've run most of the open-relay checks and none of > them come up with a "hit." > > The only thing I can think of, possibly, is that someone has a > compromised machine which is being used to relay spam through our > Exchange server. If that's the case, I don't know how I'd detect what > machine is compromised and fix it... > > Any suggestions? > Thanks > John > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange > To subscribe: http://e-newsletters.internet.com/discussionlists.html/ > To unsubscribe send a blank email to > [EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: > Jupitermedia Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. ********************************************************************** Have you clicked on yet? www.nrc.govt.nz ********************************************************************** NORTHLAND REGIONAL COUNCIL This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify [EMAIL PROTECTED] ********************************************************************** _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
