Re: SMTSVC ?

From: razornt (razornt_at_discussions.microsoft.com)
Date: 03/28/05

  • Next message: Jeff Cochran: "Re: DMZ access for internal and external users" 
    Date: Mon, 28 Mar 2005 06:35:03 -0800

    Thanks Jeff. That makes sense. I check into right away.

    "Jeff Cochran" wrote:

    > On Fri, 25 Mar 2005 13:45:05 -0800, "razornt"
    > <razornt@discussions.microsoft.com> wrote:
    >
    > >Someone is trying to hack our server via SMTPSVC. When I view the event log
    > >(system) I see Event ID 100 SMTPSVC and a login attempt. However, when I try
    > >to match the Event log time with the SMTPSVC log time nothing matches.
    >
    > Are you accounting for the offset from GMT? The SMTP logs are in GMT,
    > Event logs are usually in local time.
    >
    > Jeff
    >
    >
    > > I want
    > >to block the IP Address of this potential intruder. How do I find the IP
    > >Address of this potential intruder?
    > >
    > >SMTPSVC extended property logs are turned on with client ip, date and time,
    > >server ip and server port and also user name.
    > >
    > >Default SMTP virtual server
    > >No relay (only the list below) "There is no list"
    > >Basic and Windows Security package are checked for Authentication
    > >
    > >Thanks in advance.
    >
    >

  • Next message: Jeff Cochran: "Re: DMZ access for internal and external users"

    Relevant Pages

    • SMTSVC ?
      ... Someone is trying to hack our server via SMTPSVC. ... to match the Event log time with the SMTPSVC log time nothing matches. ...
      (microsoft.public.inetserver.iis.security)
    • Re: aspfunction does not work?
      ... >Server Application Error ... Please refer to the event log for more detail ... Finally, a full error message. ... Jeff ...
      (microsoft.public.inetserver.asp.general)
    • Re: message pending submission queue
      ... Jeff, we do not allow external users to relay through our server. ... > You can create a batch file that starts and stops SMTPSVC and this will ...
      (microsoft.public.windows.server.sbs)
    • Re: RDP /TS Admin logoff with ISA problems
      ... connect you to the 0-session on the server. ... "Jeff Meager" schreef in bericht ... >>> Nothing at all in the event log. ... A minute later the disconnected cross comes up and bang ...
      (microsoft.public.windows.server.sbs)
    • Re: IIS 4 Error message
      ... >in my event log there is now 3rd party software installed ... >on this server apart from the Mcafee AV software, ... Jeff ...
      (microsoft.public.inetserver.iis)