Re: Spam sent from my account?

From: mathab (mathab_at_discussions.microsoft.com)
Date: 01/06/05 

Date: Thu, 6 Jan 2005 05:41:04 -0800

Thanks for the ideas, it is good to hear I probably am not hacked. However
is there any way to confirm that these were not sent internally from my
network? I don't think they were but I'd like to be sure. Thanks

"Kevin Weilbacher [SBS-MVP]" wrote:

> Unless you've opened up some port you shouldn't have, and you have your
> server up to daye with security patches, and you do run a server based
> anti-virus solution -- then I doubt that your server was compromised, nor
> that those things were generated internally. As SG said, it was probably
> someone external from your site that has a virus.
>
> --
> Kevin Weilbacher [SBS-MVP]
> "The days pass by so quickly now, the nights are seldom long"
>
>
> "mathab" <mathab@discussions.microsoft.com> wrote in message
> news:D35F1B25-BAE9-4404-A069-BB0D445B7602@microsoft.com...
> > This morning I opened my email to find 50+ returned non deliverable
> > emails.
> > They were all sent from my account with the subject "Are you listed with
> > Google?". The SBS server is Standard, two nics, behind a router with only
> > necesary ports forwarded., using SMTP for mail. How can i tell if my
> > server's security is still compromised? This only happened once, and only
> > from the one account. The account in question had administrator rights; I
> > have since changed it to moble user as well as changed the password. I
> > also
> > renamed the admin account and enforced strong passwords while I was there.
> > Could this be as simple as a hacked password? How else could this happen?
> > What else can I do to make sure I am safe? Thanks for any ideas, mathab
>
>
>

Relevant Pages

  • Re: Server 2000 to 2003 connectivity
    ... the fact that the admin account is denied access ... I would guess you made a change in group policy that did this. ... other is the File Server, ...
    (microsoft.public.win2000.networking)
  • Re: lsass.exe fails and reboots
    ... that meaning either SP1 is installed, or all security patches. ... > Enterprise (acctually all 3 of our server boxes we have). ... > When i boot up in the event log there is: A critical system process, ... > sasser related posts they recommended changing the "restart when crashes" ...
    (microsoft.public.security)
  • Re: Access SMS Issue
    ... The server is currently Win2K3 SP2 ... using the SP3 upgrade download so I uninstalled and installed the original ... SMS and upgraded the console with the downloaded ... Administrator Console with my admin account on the XP workstation until I ...
    (microsoft.public.sms.admin)
  • RE: local admin account password
    ... Subject: local admin account password ... >> except its based on something specific about the server. ... >> The DB file would be encrypted with EFS so only the limited user SQL ... >> and the app itself doesn't really need to be secure as the ...
    (Focus-Microsoft)
  • Re: Event 529 Logins from external source
    ... The 7 steps will secure the server again attacking. ... This newsgroup only focuses on SBS technical issues. ... | The errors are on the SBS box, not a client machine. ... | it is the admin account and I was not sure if a lock out admin account ...
    (microsoft.public.windows.server.sbs)