Exchange Virus?

[arthur231283]

I have a mailbox on our exchange 2003 server that sent out a large amount of phishing/spam e-mails lastnight.

 

I have sophos installed on the server that covers anti-virus for the OS (server 2003) and Symantec Mail security that scans e-mails and mailboxes so the server should be covered but the only thing I can think of that could cause this is a virus

 

Is there anything I should look at or check to see why these e-mails are being sent?

 

Thanks

[bodminman]

Were the emails sent from a staff members mailbox who also happens to use his/her school laptop at home?

[danbuntu]

check you're not an open relay

[timzim]

This will help you:

 

Using the Exchange 2003 Mail Wizard

 

There's a section in here on open relay & how to close it.

Edited March 18, 2011 by timzim

[arthur231283]

Were the emails sent from a staff members mailbox who also happens to use his/her school laptop at home?

 

No, the staff don't have their own laptops and they can only access their mail box from home via OWA

[Willott]

Considering the measures you have in place on your server, have you checked message headers to confirm that the emails have come from your server (and not spoofed address by some external mail server)? If so, have you checked IIS logs to for the time the emails were sent to see if someone was logged into that account? The headers may also suggest the method used to connect to your exchange server to send the emails.

 

Cheers

 

Will

[arthur231283]

This will help you:

 

Using the Exchange 2003 Mail Wizard

 

There's a section in here on open relay & how to close it.

 

Thanks for this.

 

When I get to the step where "Receive Internet e-Mail" and "Send Internet e-mail" are ticked and I press next I get an error message:

 

To send Internet e-mail, the selected server cannot be a bridgehead server

 

ID no: c103b530

Exchange System Manger

 

I have googled the error message and not found a solution so far

[arthur231283]

Considering the measures you have in place on your server, have you checked message headers to confirm that the emails have come from your server (and not spoofed address by some external mail server)? If so, have you checked IIS logs to for the time the emails were sent to see if someone was logged into that account? The headers may also suggest the method used to connect to your exchange server to send the emails.

 

Cheers

 

Will

 

I did a search using the Message Tracking Center and it shows the e-mails being sent

[Willott]

Look for headers to confirm whether the message originated at your server or was sent through it as an open relay. If it originated at your server, check IIS logs - if the user is showing as logged on it may suggest virus/malware on their home PC, or a compromised user account.

 

Cheers

 

Will

[sukh]

Hi

 

1. You mentioned the products which have been installed. My understanding from the thread is this covers only AV. You have not mentioned AS.

2. When external mail enters your Exch Org, do you have any gateways before the message goes to the BH?

3. Do you screen AS yourself or 3rf party, e.g MessageLabs/Postini?

4. Who received the spam messages within your Org? What time? who was the sender? Track the message using ESM and determine the source.

5. Check the message headers and look at orginating IP and SCL level.

 

Post example of spam and message headers in post.

 

Sukh

[timzim]

Thanks for this.

 

When I get to the step where "Receive Internet e-Mail" and "Send Internet e-mail" are ticked and I press next I get an error message:

 

To send Internet e-mail, the selected server cannot be a bridgehead server

 

ID no: c103b530

Exchange System Manger

 

I have googled the error message and not found a solution so far

 

Sorry, my link was too vague - you shouldn't need to troll through the entire wizard. Try this instead: Setting Relay Restrictions

[arthur231283]

Sorry, my link was too vague - you shouldn't need to troll through the entire wizard. Try this instead: Setting Relay Restrictions

 

I have checked the server and the relay restrictions are set to the default settings as shown on that web page

[timzim]

What firewall do you use?

[arthur231283]

What firewall do you use?

 

We are on the LGFL network and they provide an external firewall

[arthur231283]

It did it again last night. The users mail box did not have any e-mails in the sent box but has received 170 unable to send emails.

 

The contents of the e-mail is:

 

 

"I'm afraid I had problems forwarding your message. Full details follow:

 

Subject: 'Mailbox Alert!?'

Date: 'Thu, 17 Mar 2011 18:28:46 -0000'

 

I was unable to deliver to the following recipient:

 

[email protected]

Reason: I have been attempting to forward the mail for 1.09 days and I have given up.

I have also attached the mail's original headers."

 

Here is the contents of the attachment that has the headers in:

 

"Received: from 10.218.164.8 ([10.218.164.8])

by elc-ecc-mail-01.equinoxit.net with emfmta (version 4.3.0.72.1.rd-3.2.3-libc2.3.2) vanilla id 4680026148

for [email protected]; Thu, 17 Mar 2011 18:28:35 +0000

Content-class: urn:content-classes:message

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----_=_NextPart_001_01CBE4D1.26ED8125"

X-MimeOLE: Produced By Microsoft Exchange V6.5

Subject: Mailbox Alert!?

Date: Thu, 17 Mar 2011 18:28:46 -0000

Message-ID: <6F15FB44613EFE4A939167C8E3F273280C82BF@STC-EX-001.BRIGHTON.internal>

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

Thread-Topic: Mailbox Alert!?

Thread-Index: Acvk0SWiAzVeWyxPQf+JZ+xMfcWRhw==

From: "MHS"

To:

"

[SYNACK]

It sounds like you are being backskattered. This is when someone upstream is sending spam and spoofing one of your email addresses. When these get marked as spam or denied because the address does not exist all the failure reports come back to the address that apparently sent it.

 

The best way to get around this is mave your domain name provider and get them to setup SPF records on your domain which set up rules on where email can originate from. Most antispam products now will run SPF checks on a domain name to make sure that the sender is actually alowed to be the source of an email from that domain. This does not prevent all of these types of incidents but it does totally help.

[RabbieBurns]

It sounds like you are being backskattered. This is when someone upstream is sending spam and spoofing one of your email addresses. When these get marked as spam or denied because the address does not exist all the failure reports come back to the address that apparently sent it.

 

The best way to get around this is mave your domain name provider and get them to setup SPF records on your domain which set up rules on where email can originate from. Most antispam products now will run SPF checks on a domain name to make sure that the sender is actually alowed to be the source of an email from that domain. This does not prevent all of these types of incidents but it does totally help.

 

Can you elaborate on the second paragraph? This is happening to us too, but I dont understand your solution.

[SYNACK]

Can you elaborate on the second paragraph? This is happening to us too, but I dont understand your solution.

 

Sender Policy Framework - Wikipedia, the free encyclopedia

HOWTO - Define an SPF Record

SPF Query Tool

 

Basicly it is just a text record that goes into your domain name records and defines which servers can send email for that domain. It does not prevent anyone from sending stuff spoofed from your domain but if the reciving server has a modern filter it will check the source of the email and drop it silently if it does not come from one of the sources specified in your domain record.

 

As long as your reverse DNS records are setup right, link shows up as mail.yourdomain.org in reverse lookup (which it should do anyway to avoid pre-emptive filtering) then it works quite well. Like everything to do with spam it is not full proof as not everyone implements it but it certainly helps.

[RabbieBurns]

thanks, ill have a look at our DNS records on Monday and see if I can add in a SPF

[sukh]

Hi

 

To add futher to SPF Framework, you can use the wizrad in the link below to create your records. MFST will help you for free to a cetain point. Gives you a high level overview for those who are not too technical. Valuable resource for SPF. Bear in mind, creating SPF records need to be looked into. I will not repeat everything as the link below explains well, however be carfeul if you do use 3rd party companies who use Sender Addresses as I have had to implement this for many domains, from a school perspective this may not apply, but I have come across some schools who use 3rd partys.

 

Also, configuring Exchange for SPF may have an undesirable action. If some companies don't register for SPF then this can cause issues such as email not being delivered to your Exch Org.

 

Sender ID Home Page

 

However, i;m still interested in the original post whereby the spam managed to get through. It would be interesting to see the content of one of the messages.

 

Sukh

[arthur231283]

However, i;m still interested in the original post whereby the spam managed to get through. It would be interesting to see the content of one of the messages.

 

Here is the contents of one of the e-mails that showed up in the users sent items folder:

 

This is to notify you that you are over your mailbox limit which is 250MB as set by your mailbox manager, you are currently at 257MB, you will not be able to create new e-mail to send or receive messages until you validate your mailbox. To re-validate your account, click here:

Help Desk

[arthur231283]

Also all the e-mails had the address [email protected] in the To field and had different e-mail addresses in the BCC field

[sukh]

Hi

 

@Arthur, what AS service/product are you using?

 

Sukh

[arthur231283]

what AS service/product are you using?

 

AS?

 

Anti Spyware: Sophos anti virus includes an anti spyware

Anti Spam: other than the features included with exchange/outlook none

[sukh]

Correct. AS is anit spam.

 

 

Is the AS feature turned on in Exchange?

 

Email may have been stopped if AS was being used before email hits your Exchange server. Does depend on how the message is structured and the engines/intelligence of the product.

 

As a test can you forward the original message to [email protected] and also send as an attachment item via Outlook so I can do some tests?

 

Sukh