No pop or imap allowed, actually no external access allowed at all other than BES and via webmail after accessing the Cisco's SSLVPN. I wiped his BB just for the heck of it. Also put the latest SR3 patch and Critical pdf patch on the BES.
-----Original Message----- From: Steve Szabo [mailto:steve...@gmail.com] Sent: Tuesday, January 13, 2009 9:06 PM To: MS-Exchange Admin Issues Subject: RE: Help tracking down Source of Spam If you suspect the account has become compromised, why have you not changed the password yet. If the user has POP3 of IMAP permission, you can also disallow him from using it, in case it is coming from his home machine, which may be left on all the time. If you change his password in the morning, and the spam ceases, and then it starts again in the evening, when he changes his password at home, you know where the spam is coming from. If the spam stays stopped, it was coming from a third party. \\Steve// > -----Original Message----- > From: N Parr [mailto:npar...@mortonwelding.com] > Sent: Tuesday, January 13, 2009 7:25 PM > To: MS-Exchange Admin Issues > Subject: Help tracking down Source of Spam > > I have spam msg's coming from one users account and I can't figure out > the source. Exchange 2003 sp2 and outlook 2003. The msg's aren't > coming from the users pc because they are being sent when he's shut > down. But when you boot up and open outlook it shows the msg's in his > sent items. Which means to me that they are being sent via mapi from > somewhere that has send as permissions for his account. He has a BB > so I disabled redirection just on the long shot it's infected with > something and they still keep coming. I have poured through the > server logs and I can see it sending to the recipients but can't > isolate the source of the emails. Message tracking shows him sending > the messages but I can't figure out from where. > Thanks > Niles > ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
