exchange email account sending spam how do i?

[E_G_R2]

Can anyone give me a hand trouble shooting this?

 

We have an account [email protected] that seems to be sending out emails to random address's such as [email protected] etc.. which fail then the error come back to the senders account (loads and loads of them). Apart from running a scan on their PC for a virus/Malware which shows nothing, what else can I do to stop this?

 

Rgds

[thimon]

Hi Rgds,

 

We've had both staff and students affected by this, reported to us first thing this morning. Literally hundreds of emails were sent from their accounts last night. Their AD passwords have been reset and emails reported. Sounds like it's a wider issue.

 

Thimon

[chaplic]

How do you know it's your accounts/ computing resources that are sending the spam?

 

It's trivially easy for the bad guys to send spam, and change the from address to be you. So you get all the bounces replies. Some of the bounce replies may include the original headers which will prove where it is sent from.

 

Setting up something called SPF will minimise (but not eliminate) this issue as you basically tell the internet 'we trust these guys to send email for us' and other mail systems will refuse email purporting to be from you, from other sources.

[E_G_R2]

How do you know it's your accounts/ computing resources that are sending the spam?

 

It's trivially easy for the bad guys to send spam, and change the from address to be you. So you get all the bounces replies. Some of the bounce replies may include the original headers which will prove where it is sent from.

 

Setting up something called SPF will minimise (but not eliminate) this issue as you basically tell the internet 'we trust these guys to send email for us' and other mail systems will refuse email purporting to be from you, from other sources.

 

 

Has stopped, I did disable one of the accounts but that could be coincidence. Think it may be as you said as the other account was probably harvested from our Website.