Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Security SMTP Relay spam

3 views
Skip to first unread message

User 2003 3790@discussions.microsoft.com Windows User 2003 3790

unread,
Jun 17, 2004, 4:14:01 PM6/17/04
to
Well, I have a problem with SMTP.
Anyone can send spam from my server SMTP.
I have it configuration for Restriction relay (Only list) but It not block spam hack
I found that it is a virus spam.... and It send from other pc and attack my server mail

I have install Firewall Configuration default windows
I have install symantec Co. Antivirus....

I test relay open and some results are:

220 Mail.MyDomain.com Microsoft ESMTP MAIL Service, Version: 6.0.3790.0 ready at Thu, 17 Jun 2004 14:58:13 -0600
HELO www.spa-mail.com

250 Mail.MyDomain.com Hello [219.x.x.x]

Relay test 1
MAIL FROM: <spam...@www.spa-mail.com>
250 2.1.0 spam...@www.spa-mail.com....Sender OK
RCPT TO: <rela...@www.spa-mail.com>
550 5.7.1 Unable to relay for rela...@www.spa-mail.com

RSET
250 2.0.0 Resetting

Relay test 2
MAIL FROM: <spamtest>
250 2.1.0 spamtest@anunciatehoy....Sender OK
RCPT TO: <rela...@www.spa-mail.com>
550 5.7.1 Unable to relay for rela...@www.spa-mail.com

RSET
250 2.0.0 Resetting

Relay test 3
MAIL FROM: <>
250 2.1.0 <>....Sender OK
RCPT TO: <rela...@www.spa-mail.com>
550 5.7.1 Unable to relay for rela...@www.spa-mail.com

Maybe open relay

Relay test 8
MAIL FROM: <spam...@mail.MyDomain.com>
250 2.1.0 spam...@mail.MyDomain.com....Sender OK
RCPT TO: <"rela...@www.spa-mail.com">
250 2.1.5 "rela...@www.spa-mail.com"@MyDomain

RSET
250 2.0.0 Resetting

Relay test 9
MAIL FROM: <spam...@mail.MyDomain.com>
250 2.1.0 spam...@mail.MyDomain.com....Sender OK
RCPT TO: <"relaytest%www.spa-mail.com">
250 2.1.5 "relaytest%www.spa-mail.com"@MyDomain

RSET
250 2.0.0 Resetting

Relay test 15
MAIL FROM: <spam...@mail.MyDomain.com>
250 2.1.0 spam...@mail.MyDomain.com....Sender OK
RCPT TO: <www.spa-mail.com!relaytest>
250 2.1.5 www.spa-mail.com!relaytest@MyDomain

RSET
250 2.0.0 Resetting

What I need do for Stop spam attack me server......

This Text with send attack me spam where IP [201.135.227.46] is spam attack me

From: postmaster@MyDomain
To: mscc...@microsoft.com
Date: Thu, 17 Jun 2004 14:53:43 -0600
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="9B095B5ADSN=_01C454A5C567BF300000002DMyDomain.com"
X-DSNContext: 7ce717b1 - 1160 - 00000002 - 00000000
Message-ID: <JzvEmqEi...@MyDomain.com>
Subject: Delivery Status Notification (Failure)

This is a MIME-formatted message.
Portions of this message may be unreadable without a MIME-capable mail program.

--9B095B5ADSN=_01C454A5C567BF300000002DMyDomain.com
Content-Type: text/plain; charset=unicode-1-1-utf-7

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

ni...@MyDomain.com

--9B095B5ADSN=_01C454A5C567BF300000002DMyDomain.com
Content-Type: message/delivery-status

Reporting-MTA: dns;MyDomain.com
Received-From-MTA: dns;MyDomain.com
Arrival-Date: Thu, 17 Jun 2004 14:53:42 -0600

Final-Recipient: rfc822;ni...@MyDomain.com
Action: failed
Status: 5.0.0

--9B095B5ADSN=_01C454A5C567BF300000002DMyDomain.com
Content-Type: message/rfc822

Received: from MyDomain.com ([201.135.227.46]) by MyDomain.com with Microsoft SMTPSVC(6.0.3790.0);
Thu, 17 Jun 2004 14:53:42 -0600
Message-ID: <x771111099.9759748098653821527@uwomtvprd>
From: LUNA GARCIA <mscc...@microsoft.com>
To: <ni...@MyDomain.com>
Subject: LUNA GARCIA
Date: Jue, 17 Jun 2004
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_10244_7576064.4514817025232"
X-Priority: 3
Return-Path: mscc...@microsoft.com
X-OriginalArrivalTime: 17 Jun 2004 20:53:42.0618 (UTC) FILETIME=[2C849BA0:01C454AD]

Microsoft Outlook Express 5.00.2314.1300

------=_Part_10244_7576064.4514817025232
Content-Type: text/plain;
charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable

Hi Honey!

I`m in hurry, but i still love ya...
(as you can see on the picture)

Bye - Bye: LUNA GARCIA

------=_Part_10244_7576064.4514817025232
Content-Type: application/octet-stream;
name="www.ecard.com.funny.picture.index.nude.php356.pif"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="www.ecard.com.funny.picture.index.nude.php356.pif"

I have Protect my SMTP antivirus for Symantec

Scan type: Auto-Protect Scan
Event: Threat Found!
Threat: W32.Netsky.P@mm!enc
File: C:\Inetpub\mailroot\Queue\NTFS_d7b2d1b001c454ad000001e7.EML
Location: C:\Inetpub\mailroot\Queue
Computer: MyDomain
User: SYSTEM
Action taken: Clean failed : Delete failed : Access denied
Date found: Jueves, 17 de Junio de 2004 03:06:24 p.m.


Please Help me URGENT

if you want send email to porv...@yahoo.com.mx or anoni...@hotmail.com


Jeff Cochran

unread,
Jun 18, 2004, 10:54:44 AM6/18/04
to
On Thu, 17 Jun 2004 13:14:01 -0700, "Windows User 2003 3790" <Windows
User 2003 37...@discussions.microsoft.com> wrote:

>Well, I have a problem with SMTP.
>Anyone can send spam from my server SMTP.
>I have it configuration for Restriction relay (Only list) but It not block spam hack
>I found that it is a virus spam.... and It send from other pc and attack my server mail

If you're *receiving* the mail it's not a relay. You can force users
to authenticate to SMTP and block the outgoing return if you wish.

Jeff

2003 User 3790@discussions.microsoft.com Windows 2003 User 3790

unread,
Jun 18, 2004, 11:22:01 AM6/18/04
to
Ok, but How do I it........?


"Jeff Cochran" wrote:

> If you're *receiving* the mail it's not a relay. You can force users
> to authenticate to SMTP and block the outgoing return if you wish.

> Jeff

On Thu, 17 Jun 2004 13:14:01 -0700, "Windows User 2003 3790" <Windows
User 2003 37...@discussions.microsoft.com> wrote:

Well, I have a problem with SMTP.
Anyone can send spam from my server SMTP.
I have it configuration for Restriction relay (Only list) but It not block spam hack

found that it is a virus spam.... and It send from other pc and attack my server mail

> >

Jeff Cochran

unread,
Jun 19, 2004, 10:36:52 PM6/19/04
to
On Fri, 18 Jun 2004 08:22:01 -0700, "Windows 2003 User 3790" <Windows
2003 User 37...@discussions.microsoft.com> wrote:

>Ok, but How do I it........?

Clear all the domains from the restriction Only Relay From list.
Leave the Allow Computers That Successfully Authenticate To Relay box
checked. No one can relay unless they authenticate then.

Jeff

Paul Lynch

unread,
Jun 23, 2004, 12:09:14 PM6/23/04
to
On Thu, 17 Jun 2004 13:14:01 -0700, "Windows User 2003 3790" <Windows
User 2003 37...@discussions.microsoft.com> wrote:

>Well, I have a problem with SMTP.
>Anyone can send spam from my server SMTP.
>I have it configuration for Restriction relay (Only list) but It not block spam hack
>I found that it is a virus spam.... and It send from other pc and attack my server mail
>
>I have install Firewall Configuration default windows
>I have install symantec Co. Antivirus....
>
>I test relay open and some results are:

<SNIP>

Try this KB article :

HOW TO: Prevent Mail Relay in the IIS 5.0 SMTP Server in Windows 2000
http://support.microsoft.com/?id=310356


Regards,

Paul Lynch
MCSE

0 new messages