Deleting auto-generated spam from the outbound queue

Please let others know how useful this tip is via the rating scale at the end of it. Do you have a useful Exchange or Outlook tip, timesaver or workaround to share? Submit it to our tip contest and you could win a prize.

Picture this: One afternoon, you're bombarded with pleas for help from people who've been trying to send mail all day. You check the outbound SMTP queue and -- to your horror -- find hundreds, if not thousands of identical messages.

Maybe they've been generated by some piece of malware that somehow slipped through your company's defenses, and is now trying to spam the outside world; or maybe one of your users has stupidly tried to e-mail the same 2 MB attachment to a whole slew of SMTP-only users!

The obvious way to deal with this is to stop the SMTP service and flush the queue. But what if there are other messages that legitimately need to be delivered?

There is a way to delete only the offending messages -- without using any third-party tools:

1. Open one of the offending messages and look for a couple of keywords or phrases that should distinguish it from other mail in the queue.

2. Stop the SMTP service on the Exchange server.

3. Open the directory that contains the SMTP queues if you haven't already. Usually this is the folder C:\Program Files\Exchsrvr\Mailroot\VSI 1\Queue.

4. Right-click on the Queue folder and select Search.

5. In the search window's Word or phrase in the file field, enter the phrase you're using to filter out the message in question.

6. Search for the matching messages.

7. Remove them from the queue. You don't have to delete them; they can simply be moved to another folder in the event another message that shouldn't be deleted has been trapped.

8. Restart the SMTP service and let the messages spool normally.

Since SMTP-queued ...

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Exchange Security Tips How to install Forefront Security for Exchange Server Is full email encryption the solution to Exchange security? Lock down direct file access and protect OWA users Controlling spam in Exchange 2007 at the edge transport server level When to use a self-signed certificate with Exchange Server 2007 Obtaining and verifying SSL certificates in Exchange Server How file-level antivirus software can harm your Exchange Server Understanding Exchange Server 2007 SP1 mobile security settings Which ActiveSync authentication method is best for your mobile device? Why you should secure Exchange 2007 using administrative policies Spam and virus protection How to install Forefront Security for Exchange Server Block Web beacons and protect OWA users from spam Controlling spam in Exchange 2007 at the edge transport server level How file-level antivirus software can harm your Exchange Server Problems with email spoofing on SBS 2003 Exchange Insider e-zine Securing your Exchange Server 2007 journaling archives Troubleshooting Outlook Web Access issues on a 64-bit system Microsoft Exchange Server security dos and don'ts Troubleshooting Microsoft Exchange Server Event ID error 6009 Spam and virus protection Research Microsoft Exchange Server Performance Remove Exchange 2003 objects from AD to install Exchange 2010 Outlook 2007 shut-down problems and fixes Is your Exchange 2007 hub transport server healthy? OWA 2007 configuration tricks to boost performance Pros and cons of Outlook 2007's storage engine redesign Avoid Outlook 2007 performance issues during repairs Monitor Exchange 2007 with disk- and RPC-related counters Track Exchange 2007 mailbox server health using database counters Monitoring Exchange 2007 Client Access Server role-specific counters Exchange Performance Monitor tracks domain controller communication

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary backscatter spam  (SearchExchange.com) greylist  (SearchExchange.com) image spam  (SearchExchange.com) KnujOn  (SearchExchange.com) Sender ID  (SearchExchange.com) spam confidence level  (SearchExchange.com) spamblock  (SearchExchange.com) spim  (SearchExchange.com) tarpitting  (SearchExchange.com) Vouch by Reference (VBR)  (SearchExchange.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

messages are plain text, they can be read by being dropped into Notepad or another plain text reader.

Note that some automatic spam uses randomly-generated texts to make them more difficult to filter out. However, if they're trying to propagate by sending an attachment, odds are you should be able to filter by searching for the first dozen or so characters in the encoded version of the attachment.

About the author: Serdar Yegulalp is editor of the Windows Power Users Newsletter.

Reference Center: Spam prevention and management

---

Rate this Tip To rate tips, you must be a member of SearchExchange.com. Register now to start rating these tips. Log in if you are already a member. DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.