Exchange server 2003

[sukh]

any chance of you PM me the SMTP logs?

If they are huge either zip or cut n past a section

[Ryno]

oting.aspx#errors. 0 0 255 0 390 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+SNT0-MC2-F23.Snt0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:23+-0700+ 0 0 242 0 125 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-SNT0-MC2-F23.Snt0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 266 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 266 SMTP - - - -

2012-03-29 11:53:02 65.55.92.152 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(SNT0-MC2-F23)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 407 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+SNT0-MC3-F11.Snt0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:24+-0700+ 0 0 242 0 125 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-SNT0-MC3-F11.Snt0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 250 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 250 SMTP - - - -

2012-03-29 11:53:03 65.55.92.168 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(SNT0-MC3-F11)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 375 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC2-F15.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:24+-0700+ 0 0 242 0 171 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 171 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC2-F15.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 328 SMTP - - - -

2012-03-29 11:53:03 65.54.188.94 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC2-F15)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 500 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC3-F31.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:25+-0700+ 0 0 242 0 156 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC3-F31.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 312 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 312 SMTP - - - -

2012-03-29 11:53:04 65.54.188.110 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC3-F31)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 469 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC4-F37.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:25+-0700+ 0 0 242 0 172 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 172 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC4-F37.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 328 SMTP - - - -

2012-03-29 11:53:04 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC4-F37)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 484 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC1-F32.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:26+-0700+ 0 0 242 0 156 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC1-F32.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 328 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 328 SMTP - - - -

2012-03-29 11:53:06 65.54.188.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(BAY0-MC1-F32)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 484 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+COL0-MC3-F34.Col0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:27+-0700+ 0 0 242 0 156 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 156 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-COL0-MC3-F34.Col0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 312 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 312 SMTP - - - -

2012-03-29 11:53:06 65.55.37.104 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC3-F34)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 468 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+COL0-MC2-F37.Col0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:47:27+-0700+ 0 0 242 0 157 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 157 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-COL0-MC2-F37.Col0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 313 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 313 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC2-F37)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 469 SMTP - - - -

2012-03-29 11:53:07 65.55.37.88 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 QUIT - - 0 0 4 0 485 SMTP - - - -

[Ryno]

69 0 2328 SMTP - - - -

2012-03-29 11:16:28 65.55.37.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=1232 0 0 4 0 2328 SMTP - - - -

2012-03-29 11:16:28 65.55.37.72 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 421+RP-001+(COL0-MC1-F42)+Unfortunately,+some+messages+from+195.188.250.172+weren't+sent.+Please+try+again.+We+have+limits+for+how+many+messages+can+be+sent+per+hour+and+per+day.+You+can+also+refer+to+Troubleshooting. 0 0 255 0 3234 SMTP - - - -

2012-03-29 11:16:28 65.55.37.72 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 QUIT - - 0 0 4 0 3250 SMTP - - - -

2012-03-29 11:17:07 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+server-8.tower-38.messagelabs.com+ESMTP 0 0 43 0 125 SMTP - - - -

2012-03-29 11:17:07 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 125 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-server-8.tower-38.messagelabs.com 0 0 37 0 112360 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM: 0 0 4 0 112360 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250+OK 0 0 6 0 112407 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 RCPT - TO: 0 0 4 0 112407 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250+OK 0 0 6 0 112485 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 DATA - - 0 0 4 0 112485 SMTP - - - -

2012-03-29 11:19:00 85.158.137.3 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 354+go+ahead 0 0 12 0 112516 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 220+BAY0-MC4-F22.Bay0.hotmail.com+Sending+unsolicited+commercial+or+bulk+e-mail+to+Microsoft's+computer+network+is+prohibited.+Other+restrictions+are+found+at+http://privacy.microsoft.com/en-us/anti-spam.mspx.+Thu,+29+Mar+2012+04:14:56+-0700+ 0 0 242 0 172 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 EHLO - ololprimary.co.uk 0 0 4 0 172 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 OutboundConnectionResponse SMTPSVC1 EXCHANGE - 25 - - 250-BAY0-MC4-F22.Bay0.hotmail.com+(3.15.0.97)+Hello+[195.188.250.172] 0 0 69 0 344 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 OutboundConnectionCommand SMTPSVC1 EXCHANGE - 25 MAIL - FROM:+SIZE=27073 0 0 4 0 344 SMTP - - - -

2012-03-29 11:20:35 65.54.188.126 Outbo

[timzim]

If you've just closed off open relay you might have to wait 24 hours until these other servers re-allow you to send them mail.

[2097]

check your mail server on mxtoolbox.com

 

make sure your not on any blacklists etc . Make sure you close off open relay ( if open ) and then remove your self from the blacklists

 

Another thing hackers can do is if they obtain an easy account username/password such as User/User they can authenticate against the Exchange.

 

Id recommend activating Logging on the SMTP to see whos sending out tons of emails !

[sukh]

I assume sendin gout emails to other domain are fine?

 

Can you check the domain on MXtoolbox and see what that report, i.e blacklists/open relay etc...

[Ryno]

The school is listed on a few blacklists. The relay is now closed iv also disabled accounts we dont use. How do i remove us off the blacklist?.

[PiqueABoo]

Another thing hackers can do is if they obtain an easy account username/password such as User/User they can authenticate against the Exchange.

 

Last case I saw did precisely that: Exchange 2003 was set to allow authenticated users to relay from anywhere in the world and one of their users apparently had a rubbish password. Security log was full of zillions of events for that specific user logging on (in two minds about how they got the credentials, but if there were clues in the event logs wrap round had long since vanished them).

[sukh]

For the blacklist, yu will have to contact each and check the process with them it can take some time.

[Ryno]

The smtp says

 

220 ololprimary.co.uk Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Thu, 29 Mar 2012 14:00:30 +0100

DNS Lookup failed.

Does not support TLS.

0 seconds - Good on Connection time

Not an open relay.

4.618 seconds - Good on Transaction time

 

 

and the blacklist says

 

BARRACUDA LISTED DetailReturn codes were: 127.0.0.2 105 16

IMP-SPAM LISTED DetailReturn codes were: 127.0.0.5 105 16

INPS.DE LISTED DetailReturn codes were: 127.0.0.2 15 16

LASHBACK LISTED DetailReturn codes were: 127.0.0.2 1902 16

PSBL LISTED DetailReturn codes were: 127.0.0.2 397 31

UCEPROTECTL1 LISTED DetailReturn codes were: 127.0.0.2 390 16

ivmSIP LISTED DetailReturn codes were: 127.0.0.2 401 62

[sukh]

I just done a look up and it's fine. No blacklists.

 

Can you change DNS servers used by your ISP?

[Ryno]

im not sure as we are in with the local council which is sefton. How would i find this information out?

[2097]

as shown above , your mail server is on quite a few blacklists

 

Setting Relay Restrictions

 

Set the relay restrictions to the internal network only .

 

Set the SMTP log level up ( better to check it now before you try and unblock yourself from the spam lists )

 

Check the logs and see what PC's or accounts are authenticating and sending etc.

 

We use GFI mail essentials , i noticed we had a authenticated relay attack last summer when our server sent out around 1000 emails and got us blacklisted ! .

[sukh]

Can you check a few of the messages in the queue and check the headers to see who the sender/receiver is? ANd checlk IP info

[Ryno]

There is no messages in the queue no more as these have all gone. But when there is one all it says is An SMTP protocol error occurred. This is on genuine emails from staff within the school.

[sukh]

Sorry, do you actually still have a issue now or not?

[Ryno]

yer still no joy on sending emails tried again this morning there is a few messages in the que but its postmaster send failed to deliver emails but even they are not leaving.

[timzim]

24hrs is not yet up since you closed your open relay!

[Ryno]

All sorted now!!!! Turned off all services deleted smtp protocol and the connector reset them up then started all services and its all up and running. I want to say thank you to everyone for there help!!!

[2097]

Glad its all sorted .

 

Pain in the bloody arse Exchange is when it dont work properly.

 

What makes you laugh is , before you started there they must have had such a lot of problems with exchange ! , make sure they know you sorted it out for them with a nice staff email explaining .

[Ryno]

I no learned loads about exchange now haha. Yer they said exchange has never worked correct haha wonder why. Surprised we aint black listed the amount of emails that were in the queue.

[2097]

Well the lists did say you was blacklisted on 4 lists .

 

The previous tech has probally never requested to be removed , IRC you can only ask a few times !

 

So make sure everything is closed up , all holes etc before you request removal .