Help: Spam problem with Exchange!

We were told by our ISP that we are sending SPAM emails
and we were given an example email that we sent. When I
traced that example SPAM email under Exchange Message
Tracking Center, it is shown as From: xxx@africamail.com
To: a list of email addresses including us.
The Event is shown as:
SMTP: Message Submitted to Advanced Queuing
SMTP: Started Message Submission to Advanced Queue
SMTP: Message Submitted to Categorizer
SMTP: Started Outbound Transfer of Message
---
My question is if the message is from from someone (Spam)
to us why it is shown as "SMTP: Started Outbound Transfer
of Message"? i.e we are sending out this Spam again. Is
there somewhere in the Exchange (Windows 2000 SBS) can
prevent this happen?

Many thanks

Leigh

anonymous
Tue Aug 10 10:10:04 CDT 2004

After checking the relevant pages on smallbizserver.net,
I realised that it must be the relay problem. I have done
what have been suggested in KB 324958, but there are
still Spam email sending out (relay). Can't see anything
suspicious under application log.

Any suggestions would be very much appreciated.

Leigh

Lanwench
Tue Aug 10 22:25:17 CDT 2004

E2k out of the box is not an open relay, but it does allow for authenticated
relay. If someone has enabled the Guest account, or you don't have a very
good password policy, you may be exploited:

See http://www.vamsoft.com/orf/authattack.asp

I turn off authenticated relay immediately when I set up a server.

Leigh wrote:
> We were told by our ISP that we are sending SPAM emails
> and we were given an example email that we sent. When I
> traced that example SPAM email under Exchange Message
> Tracking Center, it is shown as From: xxx@africamail.com
> To: a list of email addresses including us.
> The Event is shown as:
> SMTP: Message Submitted to Advanced Queuing
> SMTP: Started Message Submission to Advanced Queue
> SMTP: Message Submitted to Categorizer
> SMTP: Started Outbound Transfer of Message
> ---
> My question is if the message is from from someone (Spam)
> to us why it is shown as "SMTP: Started Outbound Transfer
> of Message"? i.e we are sending out this Spam again. Is
> there somewhere in the Exchange (Windows 2000 SBS) can
> prevent this happen?
>
> Many thanks
>
> Leigh

Lafreak
Thu Aug 12 19:50:29 CDT 2004

Go the the properties of the SMTP virtual server in exchange click the
access then relay tab and make sure there are no ip address or domains in
the list also make sure the tick at the bottom is turned off and you can
also go the the properties on the SMTP connector tab then click access tab
and make sure allow messages to be relayed to these domains is not ticked.
You don't need anyone relaying through your server if you have a remote
user dialing up through their isp and using a mail client to access their
mail IMAP or POP use the isp smtp to send and pop your sbs server.
Peter.
"Leigh" <anonymous@discussions.microsoft.com> wrote in message
news:353201c47ecb$21d059e0$a401280a@phx.gbl...
> We were told by our ISP that we are sending SPAM emails
> and we were given an example email that we sent. When I
> traced that example SPAM email under Exchange Message
> Tracking Center, it is shown as From: xxx@africamail.com
> To: a list of email addresses including us.
> The Event is shown as:
> SMTP: Message Submitted to Advanced Queuing
> SMTP: Started Message Submission to Advanced Queue
> SMTP: Message Submitted to Categorizer
> SMTP: Started Outbound Transfer of Message
> ---
> My question is if the message is from from someone (Spam)
> to us why it is shown as "SMTP: Started Outbound Transfer
> of Message"? i.e we are sending out this Spam again. Is
> there somewhere in the Exchange (Windows 2000 SBS) can
> prevent this happen?
>
> Many thanks
>
> Leigh
>
>