SBS 2003 Smtp port

Hi,

i have an issue with an SBS server. The SMTP service is running in services. yet when i try to run default smtp virtual server in exchange system manager i get the following error

Event Type:      Error
Event Source:      SMTPSVC
Event Category:      None
Event ID:      115
Date:            16/03/2009
Time:            13:35:04
User:            N/A
Computer:      APSERVER01
Description:
The service could not bind instance 1.  The data is the error code.

For more information, see Help and Support Centre at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 40 27 00 00               @'..    

I have changed the port for the default SMTP and it starts fine. Yet when you change it back to 25 it no longer works.

If I telnet to it I get the following error

Invalid user.

Connection to host lost.

C:\Documents and Settings\rich>

It looks like something else has taken control of port 25, but i cant find what it is.

Thanks in advance.
LVL 3
durgeAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

acromentCommented:
Are you reciving email to the server? Has anything changed on your server which caused this to stop working?

Are you using any programs to filter email for viruses or Spam which is installed on your server? What products?

Thanks,
eric
0
durgeAuthor Commented:
the only thing that has changed was wamp was installed on thursday by there web developer. however this is not running and both the wamp services are stopped.

They use cloudmark for webfiltering however this has been this way for months and worked withotu any issues.
0
suppsawsCommented:
Hello durge,

since you have an SBS server, you should use the WIZARDS.
rerun the CEICW and check for any errors.
http://www.sbs-rocks.com/sbs2k3/sbs2k3-n2.htm
and for the logs (in case of errors): http://sbs.editme.com/logs

Regards,

suppsaws
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Put the Hammer Down
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
From the command line:
netstat -an >c:\ports.txt
notepad c:\ports.txt

Look for TCP 25 and see what's listenning on the port.

If a PID is given then from the command line:
tasklist /svc
Associate the PID with the service and work on getting rid of it or reconfiguring it.

Philip
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
durgeAuthor Commented:
I get a load messages like

TCP    192.168.18.2:25        123.123.123.123.:49345     TIME_WAIT

the 123.123.123.123 addrersses are public IP addresses I do not recocnise (mai being delivered?)
The ports are all different and VERY high mostly in the 50000 + range
No PID...
0
suppsawsCommented:
hm, sure this isn't any spyware running on port 25? did you do a scan?
0
durgeAuthor Commented:
I;ve ran malwarebytes an it hasnt picked anything up. will run spybots and adawre now. but i havent seen any of the normal signs of spyware whilst trouble shooting this.
0
suppsawsCommented:
and also check for open relay:
http://www.amset.info/exchange/smtp-openrelay.asp
0
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Get:
PortQryv2
http://www.microsoft.com/downloads/details.aspx?FamilyID=89811747-C74B-4638-A2D5-AC828BDC6983&displaylang=en

Run the above process using the PortQryv2 and you will get your PID.

Philip
0
durgeAuthor Commented:
Tested open relay and it is not, have up to date AV, running spybot now but clean so far...
0
durgeAuthor Commented:
I ran portqry.exe -n 192.168.18.2 -e 25 -p TCP

And got the bellow basically saying invalid user, this was done logged in as administrator

Querying target system called:

 192.168.18.2

Attempting to resolve IP address to a name...


IP address resolved to myserver.mydomain.local

querying...

TCP port 25 (smtp service): LISTENING

Data returned from port:
Invalid user.
portqry.exe -n 192.168.18.2 -e 25 -p TCP exits with return code 0x00000000.
0
suppsawsCommented:
about that 'wamp', are you sure that isn't taking over port 25?
btw, the "X" is a number that corresponds to one or more of your defined Web sites that are using Host Headers.
btw, have you read this?
http://support.microsoft.com/kb/190008
http://support.microsoft.com/kb/284984
could be alot, one more thing I think about, is skype installed on this server?
0
suppsawsCommented:
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.