I found the following on my internal SMTP Notes Server. The External SMTP gateway (non Notes) delivered a mail to a notes user and right after that the Notes SMTP server started sending out emails to the world.
Seems like some sort of mailing virus (See Notes Log below) ... How can I find out where it originated from or if it was related to the mail "0075E5C4" delivered to Jane Doe
06/08/2007 05:27:45 PM SMTP Server: 172.x.x.x connected
06/08/2007 05:27:45 PM SMTP Server: Message 0075E5C4 received
06/08/2007 05:27:45 PM SMTP Server: 172.x.x.x disconnected. 1 message[s] received
06/08/2007 05:27:46 PM Router: Message 0075E5C4 delivered to Jane Doe/DEPT xxx/xxx/xxx
06/08/2007 05:28:54 PM Router: Transferring mail to domain 172.x.x.x (host 172.x.x.x [172.x.x.x]) via SMTP
06/08/2007 05:28:54 PM Router: Transferred 1 messages to 172.x.x.x (host 172.x.x.x) via SMTP
06/08/2007 05:28:59 PM Router: Message 0075FE8D transferred to 172.x.x.x for 102355.2216@compuserve.com via SMTP
06/08/2007 05:28:59 PM Router: Message 0075FE8D transferred to 172.x.x.x for 102355.2217@compuserve.com via SMTP
06/08/2007 05:28:59 PM Router: Message 0075FE8D transferred to 172.x.x.x for 102355.2220@compuserve.com via SMTP
06/08/2007 05:28:59 PM Router: Message 0075FE8D transferred to 172.x.x.x for 102355.2221@compuserve.com via SMTP
06/08/2007 05:28:59 PM Router: Message 0075FE8D transferred to 172.x.x.x for 102355.2222@compuserve.com via SMTP
06/08/2007 05:28:59 PM Router: Message 0075FE8D transferred to 172.x.x.x for 102355.2223@compuserve.com via SMTP
Print this page
