sorry about that second email about the same thing... and thanks for having the patience to answer it !
I sent the first one yesterday and when it didnt show up for a long time on the list I send another. This afternoon there were over 15,000 files in the spool folder! So, I stopped all the imail services and noticed that there were still some smtp32.exe's in the taskmanager, so i set all the imail services to start manually and rebooted. when the server came back, i moved all the queue files out of the spool and into a temp dir. I then installed the new 7.07 full install over the top, set the services to start automatically and rebooted. It looked like the spool folder was working normally, so i dumped all of the old queue files back into the spool folder (about 30,000 files total, counting the d & the q files). Within an hour and a half, the spool folder was down to having only 300 files in it! So, what do you think could have caused this? We have had a problem with address harvesters for some time but lately it has gotten a lot worse. The funny thing is that out of all our domains, several of which have several thousand addresses, the only one they are harvesting is @oct.net which only has about 400 accounts ! Anyway, these jerques are hitting my server about 50,000 times a day from a ton of different ip addresses... I noticed on blackice on my workstation that they have a rule that will deny these attacks, so I got the server version and installed it on my server. Has anyone had any experience with black ice or some other ids for this application? Thanks for all your help! Jim ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, April 20, 2002 6:27 PM Subject: Re: [IMail Forum] lots of declude processes and not many smtp... 8000+ files in the spool > > >Is it normal to have 20 or so declude process running, not many smtp32 > >processes and 8000+ spool files in the spool folder? there are also 8000+ > >files in the spool\overflow folder. > > > >all of these files ARE from today. we keep our spool directory very clean! > > Normally, most users will only have 1-2 declude processes running at the > same time. However, the 8,000+ spool files dated today is a dead > giveaway: Something ain't right. > > With 8,000 files in the spool directory (and the high number of > declude/smtp32 processes), you are most likely dealing with either a > spammer or a mail loop of some sort. All you need to do is look at a few > of those files in the spool to get a good idea as to what is going > on. Just look for the pattern: Do they all contain the same text? Are > they all to/from the same user? Something in those files should provide a > clue as to what is going on. > > -Scott > --- > Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for > IMail. http://www.declude.com > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > to be removed from this list. > > An Archive of this list is available at: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Please visit the Knowledge Base for answers to frequently asked > questions: http://www.ipswitch.com/support/IMail/ > Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
