Please: Desperate Help - Exchange

bremner · 09-02-2008, 05:52 AM

Hi everyone. i am in real trouble here. I have a server running sbs server 2003 with 50 users and exchange server. As of Today we have been black listed by two antispam websites one being spamcop. I have checked that exchange is set up correctly so that it is not an open relay and even done the telnet test. I went through the ques and there is nothing unusuall that i can see but if some one can take a look that would be great. This is a really big problem for me and your help would be unbelievably appreciated.

Mark

ForumKB · 09-02-2008, 05:59 AM

As a quick fix you can get a smart host to relay your mail, is it you thats been blacklisted or your ISP?

bremner · 09-02-2008, 06:36 AM

Thanks Adrian,

But it is my domain name that has been black listed.

bremner · 09-02-2008, 10:48 PM

I have gone through my message logs and some one is using ua@mydomain.com.au,r@mydomain.com.au etc. these arent even valid accounts

ForumKB · 09-03-2008, 01:26 AM

Have these messages originated from within your organisation or have you found these from failiure reports that have come from someone spoofing your addresses, if it's the former then I'd double check the relay settings on your SMTP server and general security(and check no one is sending this from within your organisation of course!), if it's the latter I would contact the blacklist companies as this isn't something under your control and they can be a bit quick to blacklist domains without properly checking where the mail came from.

Either way you will need to contact the blacklist providers as they should have some form of procedure for getting back off the list.

I get a couple of hundred failiure reports a week from people spoofing my domains, b*stards . . . .

bremner · 09-04-2008, 12:11 AM

Hi ForumKB

After searching the blacklisted sites one of them was very informative. We have been infected by the Rustock virus. It is actually our gateways ip address that has been banned which is the saim as the mail servers. we have a netcomm nb6 router and i am wondering if anyone knows the correct way to block all users from using port 25 but allow both our terminal server and mail server to access. Also i have disinfected all users pc's but i am not sure what to do about the fileserver and terminal server. They run windows sbs 2003 and terminal server 2000. i used DRWeb cureit on the pc's but i dont know if it is safe to use on fs and ts. I use Trend officescan and trend scanmail but they seem unable to even detect this virus.

Thankyou in advanced

bremner · 09-04-2008, 10:38 PM

Still need help please,

I have sorted most of the problems but i still have problems sending to two domains, iinet.net and bigpond.com. Messages are being stuck in the smtp connector i have posted the que and the message tracking report as well. Could some one please tak a look for me. Thanks

09-02-2008, 05:59 AM	#2 (permalink)
ForumKB Registered User Join Date: Mar 2008 Location: UK Posts: 66 OS: XP	Re: Please: Desperate Help - Exchange As a quick fix you can get a smart host to relay your mail, is it you thats been blacklisted or your ISP? __________________ Adrian Paris Google search of just tech forums & articles (very useful, honest!)

09-02-2008, 06:36 AM	#3 (permalink)
bremner Registered User Join Date: Jun 2008 Posts: 160 OS: Server 2003	Re: Please: Desperate Help - Exchange Thanks Adrian, But it is my domain name that has been black listed.

09-02-2008, 10:48 PM	#4 (permalink)
bremner Registered User Join Date: Jun 2008 Posts: 160 OS: Server 2003	Re: Please: Desperate Help - Exchange I have gone through my message logs and some one is using ua@mydomain.com.au,r@mydomain.com.au etc. these arent even valid accounts

09-03-2008, 01:26 AM	#5 (permalink)
ForumKB Registered User Join Date: Mar 2008 Location: UK Posts: 66 OS: XP	Re: Please: Desperate Help - Exchange Have these messages originated from within your organisation or have you found these from failiure reports that have come from someone spoofing your addresses, if it's the former then I'd double check the relay settings on your SMTP server and general security(and check no one is sending this from within your organisation of course!), if it's the latter I would contact the blacklist companies as this isn't something under your control and they can be a bit quick to blacklist domains without properly checking where the mail came from. Either way you will need to contact the blacklist providers as they should have some form of procedure for getting back off the list. I get a couple of hundred failiure reports a week from people spoofing my domains, b*stards . . . . __________________ Adrian Paris Google search of just tech forums & articles (very useful, honest!)

09-04-2008, 12:11 AM	#6 (permalink)
bremner Registered User Join Date: Jun 2008 Posts: 160 OS: Server 2003	Re: Please: Desperate Help - Exchange Hi ForumKB After searching the blacklisted sites one of them was very informative. We have been infected by the Rustock virus. It is actually our gateways ip address that has been banned which is the saim as the mail servers. we have a netcomm nb6 router and i am wondering if anyone knows the correct way to block all users from using port 25 but allow both our terminal server and mail server to access. Also i have disinfected all users pc's but i am not sure what to do about the fileserver and terminal server. They run windows sbs 2003 and terminal server 2000. i used DRWeb cureit on the pc's but i dont know if it is safe to use on fs and ts. I use Trend officescan and trend scanmail but they seem unable to even detect this virus. Thankyou in advanced