Problem with large amount of email being sent out

[Board4aLiving]

I also have another problem with the same sbs2003 server where after looking at the usage report, 1 user is reported to have sent out over 6000 external emails. There is no way in hell that this old lady is sending out that many emails in such a short amount of time.

I do have Norton mail security installed which would pickup any spam mail that a program might produce because of a virus or somthing, but nothing is showing up in that. There is nothing in event viewer jumping out at me saying that there is a problem. I have also made sure that exchange is not being used as a relay.

Any thoughts?

Board4aLiving

 

[Albion]

Check the machine for a backdoor trojan that makes the SMTP server on that machine an open relay.

If you are running security software on your network (firewall/anti-virus/anti-spyware) please ignore the next paragraph.

I don't mean to sound like an ass here but you should really run managed Virus and Firewall at the Client, Server, Gateway, and Mail levels on any network. People who don't run such security software are as much to blame for the problem that exists on the internet as those who are writing the malware. I don't mean to sound harsh here but I have learned over the years to be that way just to convince customers who would remove the expense of security software from a network install just to save money.

Good Luck

-Al

 

[Board4aLiving]

No offese taken. I feel the same way as well.

Yes, I do have a completly managed network utilizing Norton Antivirus Corporate Edition w/ Mail Security. I have Norton's set to scan server and clients daily at night. That is why all of this is so confusing. Nothing shows up in any logs other than the usual failed to scan error cause a file is in use. But all those files are legit.

Any other Ideas?

Board4aLiving

 

[ascotta]

You don't have Exchange running as a potential Open relay ?

[blue]Arguably the best cat skinner around ! [/blue]

Cheers
Scott

 

[Board4aLiving]

I followed a knowledge base article on making sure that it's not being used as an open relay, only for authenticated users. The problem is is that its showing up that this user is sending out all that mail. It shows up in the usage report.

Board4aLiving

 

[ascotta]

Check their PC for a virus methinks.

[blue]Arguably the best cat skinner around ! [/blue]

Cheers
Scott