|
Home > Archive > IIS and SMTP > April 2005 > Lots of Sender Unspecified Messages in Queue
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Lots of Sender Unspecified Messages in Queue
|
|
|
| Running Windows 2000 IIS/SMTP
Since last week, the inetpub\mailroot\queue folder fills up with lots
(300-400 at a time) of emails that are zero bytes in size. When I look at the
these messages, the from address has "Sender Unspecified". The "empty" emails
eventually disappear.
Any ideas?
| |
| Peter D. Hipson 2005-04-22, 7:53 am |
| Open server, perhaps?
Look at the origin IP, is it yours?
Look at the destination, do you know who they are?
Most likely someone is spamming through you, or there is a virus/worm
infection on a machine on your network.
On Wed, 20 Apr 2005 13:39:02 -0700, "markj"
<markj@discussions.microsoft.com> wrote:
>Running Windows 2000 IIS/SMTP
>Since last week, the inetpub\mailroot\queue folder fills up with lots
>(300-400 at a time) of emails that are zero bytes in size. When I look at the
>these messages, the from address has "Sender Unspecified". The "empty" emails
>eventually disappear.
>Any ideas?
PeterD, the Darkstar Network
To email, fix my address!
ExpertZone!
| |
|
| According to dnsreport.com the servers (there are 2 showing the same
symptoms)are not open for relay. All of the IP addresses are external (i.e.
nothing to do with me)
How can I check if it is a virus/worm on another machine?
"Peter D. Hipson" wrote:
> Open server, perhaps?
>
> Look at the origin IP, is it yours?
>
> Look at the destination, do you know who they are?
>
> Most likely someone is spamming through you, or there is a virus/worm
> infection on a machine on your network.
>
> On Wed, 20 Apr 2005 13:39:02 -0700, "markj"
> <markj@discussions.microsoft.com> wrote:
>
>
> PeterD, the Darkstar Network
> To email, fix my address!
> ExpertZone!
>
| |
| Peter D. Hipson 2005-04-25, 5:53 pm |
| On Fri, 22 Apr 2005 06:56:03 -0700, "markj"
<markj@discussions.microsoft.com> wrote:
>According to dnsreport.com the servers (there are 2 showing the same
>symptoms)are not open for relay. All of the IP addresses are external (i.e.
>nothing to do with me)
>How can I check if it is a virus/worm on another machine?
>
Uh, do a virus scan? Look into AVG, they are good. Can you post a
complete set of unedited headers here? The reason why is that if all
the IPs are external, then you must have an open server. Either you
have missed something in the headers that is a clue, of there is
something fishy about dnsreport.com's scan. (Not them, just that it
missed something...)
PeterD, the Darkstar Network
To email, fix my address!
ExpertZone!
| |
| Peter D. Hipson 2005-04-25, 5:53 pm |
| I don't see anything at DNSREPORT.COM that tests for open servers/open
relays. Try running an open relay site to test your installation.
On Fri, 22 Apr 2005 06:56:03 -0700, "markj"
<markj@discussions.microsoft.com> wrote:
>According to dnsreport.com the servers (there are 2 showing the same
>symptoms)are not open for relay. All of the IP addresses are external (i.e.
>nothing to do with me)
>How can I check if it is a virus/worm on another machine?
>
PeterD, the Darkstar Network
To email, fix my address!
ExpertZone!
|
|
|
|
|