Running Windows 2000 IIS/SMTP
Since last week, the inetpub\mailroot\queue folder fills up with lots
(300-400 at a time) of emails that are zero bytes in size. When I look at th
e
these messages, the from address has "Sender Unspecified". The "empty" email
s
eventually disappear.
Any ideas?

[ Post a follow-up to this message ]

Open server, perhaps?

Look at the origin IP, is it yours?

Look at the destination, do you know who they are?

Most likely someone is spamming through you, or there is a virus/worm
infection on a machine on your network.

On Wed, 20 Apr 2005 13:39:02 -0700, "markj"
<markj@discussions.microsoft.com> wrote:

>Running Windows 2000 IIS/SMTP
>Since last week, the inetpub\mailroot\queue folder fills up with lots
>(300-400 at a time) of emails that are zero bytes in size. When I look at t
he
>these messages, the from address has "Sender Unspecified". The "empty" emai
ls
>eventually disappear.
>Any ideas?

PeterD, the Darkstar Network
To email, fix my address!
ExpertZone!

[ Post a follow-up to this message ]

According to dnsreport.com the servers (there are 2 showing the same
symptoms)are not open for relay. All of the IP addresses are external (i.e.
nothing to do with me)
How can I check if it is a virus/worm on another machine?

"Peter D. Hipson" wrote:

> Open server, perhaps?
>
> Look at the origin IP, is it yours?
>
> Look at the destination, do you know who they are?
>
> Most likely someone is spamming through you, or there is a virus/worm
> infection on a machine on your network.
>
> On Wed, 20 Apr 2005 13:39:02 -0700, "markj"
> <markj@discussions.microsoft.com> wrote:
> 
>
> PeterD, the Darkstar Network
> To email, fix my address!
> ExpertZone!
>

[ Post a follow-up to this message ]

On Fri, 22 Apr 2005 06:56:03 -0700, "markj"
<markj@discussions.microsoft.com> wrote:

>According to dnsreport.com the servers (there are 2 showing the same
>symptoms)are not open for relay. All of the IP addresses are external (i.e.
>nothing to do with me)
>How can I check if it is a virus/worm on another machine?
>

Uh, do a virus scan? Look into AVG, they are good. Can you post a
complete set of unedited headers here? The reason why is that if all
the IPs are external, then you must have an open server. Either you
have missed something in the headers that is a clue, of there is
something fishy about dnsreport.com's scan. (Not them, just that it
missed something...)
PeterD, the Darkstar Network
To email, fix my address!
ExpertZone!

[ Post a follow-up to this message ]

I don't see anything at DNSREPORT.COM that tests for open servers/open
relays. Try running an open relay site to test your installation.

On Fri, 22 Apr 2005 06:56:03 -0700, "markj"
<markj@discussions.microsoft.com> wrote:

>According to dnsreport.com the servers (there are 2 showing the same
>symptoms)are not open for relay. All of the IP addresses are external (i.e.
>nothing to do with me)
>How can I check if it is a virus/worm on another machine?
>

PeterD, the Darkstar Network
To email, fix my address!
ExpertZone!

[ Post a follow-up to this message ]