Re: Tracking source of outbound SMTP messages

Kevin,

>The virus, I think, installs it's own smtp server. 

But even so, it has to send it to some other server.  So either it has to send
it directly to a known open relay, or it has to grab the configured server from
the PC's email configuration.  If it does the latter, what it would get is the
address of the local 400.  Hence the 400 may still see the traffic.  And in
fact, since the outbound byte counts under NETSTAT *CNN were increasing
steadily, I figured the 400 was in the loop.  If it sent it itself to an open
relay, then the 400 stats would not be affected.

>Does your firewall allow outgoing on port 25 from any or just the 400's 

It was allowing it from any; I changed it to only allow from the 400.  As
suspected though, it made no difference since the mail was outbound from the
400.

See also my reply to Jim though.

Doug