Excuse me. Symantec said they weren't aware of any virus that can put dummy addresses in the To and From fields? I find that hard to believe since the Klez virus, among others, does this very thing and they are certainly aware of that virus.
As for your original issue about the spam delete the messages that you know are spam and re-check your open relay situation. It sounds like there is a hole somewhere that you didn't plug. Check Q articles Q260973 Q265293 Q313395 Nate Couch EDS Messaging > ---------- > From: Jay Kulsh > Reply To: Exchange Discussions > Sent: Sunday, November 2, 2003 11:17 PM > To: Exchange Discussions > Subject: Spam Clogging the IMC Queue -- Feigning Open Relay > > Hi folks, > > We do not have open relay on our two Exchange servers (5.5 SP4) as tested > by > various tools. However in the queue of IMC, there are thousand of messages > that have outside domains in both source and destination addresses. The > addresses of originators are obviously computer generated with words like > [EMAIL PROTECTED], [EMAIL PROTECTED] etc. We have no proof yet that any of > these > messages are actually delivered -- as if we were open realy -- to the > destination domain but that is a possibility. > > Symantec techsupport stated that they are not aware of any virus or worm > that can do this. > > If we are not allowing open-relay what is causing these messages to get to > our IMC queue? Please help! > > Jay > __________ > Jay Kulsh > iLAN > Pasadena, CA > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&la > ng=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
