Help, I think our email server is infected

[Dyngoe]

Hi Y'all,

I recently recieved a bunch of emails returned to me that make me very suspicious. We're running our server offsite, so I believe they do a good job weeding out worms and the like, but we have recieved some interesting return mail recently. Here's an example:
----- The following addresses had permanent fatal errors -----
outlets@sweet2stepwiseu.com
clau@sweet.turdera.com
mellow@sweet.tender.soft.com
family@sweet.swin
captainmorgan@sweet.rum
field@sweet.on
nk3195@sweet.ocn.ne.jp
misti@sweet.net
pepi8@sweet.commo.de
cosmic@sweet.commo.de
pc@sweet.com
firco@sweet.com
dice@sweet.com
candi@sweet.com
patty@sweet.cakes
muffin@sweet.bakery.yum.yum
contemplatist@sweepwashingsa.com
buddhahood@sweepwashingsa.com
portunidae@sweepwashings.com
midpoint@sweepwashings.com
dol@sweepwashings.com
civilising@sweepwashings.com
enet@sweepthenet.com
ort@sweepstakesonline.com
newlook@sweepstakesonline.com
francisl@sweepstakesonline.com
fo@sweepstakesonline.com
builder@sweepstakesonline.com
decker@sweepstakemacedonia.net
bromine@sweepstakeletterhead.net
bromine@sweepstakeletterhead.n
duger@sweepsote.com
client@sweepscity.com
freeman@sweeping.up.the.opposition
conquer@sweeperssmuensterk.com
ed@sweepersj.com
oceans@sweepers.evidencep.net
environal@sweepage.com
conclusively@sweepage.com
mike@sweenywalter.com
dave@sweeney.com

----- Transcript of session follows -----
winner@isp.com... Deferred: Connection refused by isp.com.
553 sweet2stepwiseu.com.designinsites.com. config error: mail loops back to
me (MX problem?)
554 outlets@sweet2stepwiseu.com... Local configuration error
... while talking to sweet.turdera.com.:
>>> RCPT To:<clau@sweet.turdera.com>
<<< 550-Host server1.designinsites.com (www.designinsites.com)
[209.61.186.173] is not permitted
<<< 550-to relay through rh-01-ar.wavenet.com.ar.
<<< 550-Perhaps you have not logged into the pop/imap server in the last 30
minutes.
<<< 550-You may also have been rejected because your ip address
<<< 550-does not have a reverse DNS entry.
<<< 550 relaying to <clau@sweet.turdera.com> prohibited by administrator
550 clau@sweet.turdera.com... User unknown
... while talking to sweet.tender.soft.com.:
>>> RCPT To:<mellow@sweet.tender.soft.com>
<<< 550 <mellow@sweet.tender.soft.com>... Relaying denied
550 mellow@sweet.tender.soft.com... User unknown
553 sweet.swin.designinsites.com. config error: mail loops back to me (MX
problem?)
554 family@sweet.swin... Local configuration error
553 sweet.rum.designinsites.com. config error: mail loops back to me (MX
problem?)
554 captainmorgan@sweet.rum... Local configuration error
553 sweet.on.designinsites.com. config error: mail loops back to me (MX
problem?)

ETC.... ETC.....

Anyone know what the f&*K is going on? Thanks in advance.

As Always,
D

 

[bozo1]

Sounds like your SMTP server is an open relay (SLAP) and you are seeing the results of people bouncing spam off your server.

 

[blstriker]

If your server is an open relay, some places might not accept email from your domain/ip number. Make sure the relay is closed!