Question

SMTP queues sending spam. How can i find what PC is sending these messages

SMTP, Exchange 2003, Spam, Exchange security

A question submitted on SearchExchange.com


It appears a PC on our network has a virus. This morning I found a few hundred messages in the SMTP queues being sent from security@eppi-card.com and security@eppi-card.co.us to hundreds of domains. Is there a way to see which PC sent these messages? Maybe a log showing the IP address that submitted the messages to the SMTP queue? I'm running Exchange 2003.

Take a look at the message headers on the spam messages. A website that can assist with this task is here. You will be looking for the ip address of the first device in the chain. This will give you the host IP address (provided DHCP is not in use and the address has been released).

You could also scan your network for devices sending traffic on port 25.