Outbound Spam - few users

Noticed 10,000 emails in the spool last week. Two users were responsible it seemed. Disabled both users and cleared the spool. Whenever I enable either user, after changing the password, the user logs in to the web portal and the spam begins again. Malware scans on PC show nothing. Could this be something inside their mail store?

Linda Pagillo Replied

6/20/2018 at 10:57 AM

Hi David. Did you restart the SM service after changing their passwords? Sometimes the sessions from the spammers stay connected until you do so even though you have changed the passwords. Also, to prevent this from happening, check out our free program Declude and it's Hijack component. Here are a few KB articles about it...

http://know.mailsbestfriend.com/declude_hijack--1937121164.shtml

http://know.mailsbestfriend.com/hijacked_email_account--1189325784.shtml

http://know.mailsbestfriend.com/hijack_has_permanently_held_email-1043235164.shtml

http://know.mailsbestfriend.com/hijack_held_email_notification-1743303226.shtml

http://know.mailsbestfriend.com/how_to_allow_certain_users_and_ips_to_bypass_declude_hijack-601646214.shtml

Please let me know if you have any questions and I will be happy to help. Thanks!

Linda Pagillo Mail's Best Friend Email: linda.pagillo@mailsbestfriend.com Web: www.mailsbestfriend.com Authorized SmarterTools Reseller Authorized Message Sniffer Reseller

David Short Replied

6/21/2018 at 8:22 AM

Thanks a ton Linda. I have installed the declude and configured it to monitor and hopefully stop outbound spam.

I wasn't able to find the hijack component on their website but I will keep looking.

Linda Pagillo Replied

6/21/2018 at 8:40 AM

You're welcome David. The Hijack component is included in the install. If you go to your Declude directory, you will see a file called hijack.cfg.off. Rename it to hijack.cfg and that will turn it on. Be sure to open it and make sure that HIJNOTIFY and HIJADDR are both set to ON and that they are uncommented. Also be sure to edit the HijackNotify.eml so that the alerts get sent to an email address of your choice when mail is held. Also, please check out our Hijack manual so you can understand exactly how it works: http://mailsbestfriend.com/downloads/docs/Declude_Hijack_Manual.pdf Please let me know if you have any questions. Thanks!

Linda Pagillo Mail's Best Friend Email: linda.pagillo@mailsbestfriend.com Web: www.mailsbestfriend.com Authorized SmarterTools Reseller Authorized Message Sniffer Reseller

3 Replies

Reply to Thread

Related Knowledge Base Articles

3 Replies

Reply to Thread

Tags

Related Knowledge Base Articles