Exchange 2003 SBS - Compromised???

DETAILS
Exchange 2003 SBS

ISSUE
Client sent me a screen shot this morning of the Queues and it looks like there is either a bug or the system has been compromised.  I see lots of outbound messages in the Queue that are definitely spam (As in they are using this server to relay spam).

REQUEST
Could someone remind me how to properly turn on the correct logging so I can see what account is being used to send  the messages.

Also any steps that I should make sure I take after I figure it out (other than change the password) would be helpful.

Regards,
LVL 3
tech911Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Alan HardistyCo-OwnerCommented:
My article should help you here:

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_2556-Why-are-my-outbound-queues-filling-up-with-mail-I-didn't-send.html

Also, please have a read of my two blog articles:

http://alanhardisty.wordpress.com/2010/09/28/increase-in-frequency-of-security-alerts-on-servers-from-hackers-trying-brute-force-password-programs/

http://alanhardisty.wordpress.com/2010/12/01/increase-in-hacker-attempts-on-windows-exchange-servers-one-way-to-slow-them-down/

My EE article discusses how to identify the abused account but my 2nd blog discusses a way to stop it happening dead without knowing the account.  Your call as to the way you choose to stop this.

You can also use aqadmcli.exe to quickly empty your queues:

http://community.spiceworks.com/how_to/show/267

Alan
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tech911Author Commented:
On site at client.

Just looked at Queue.

Pulled up Queued Items, had two messages in it.

One was random name, One was postmaster.

Also ran diagnostics log as per your article, no event ID's of 1708

Where should I look?  What are my next steps...

BELOW IS JUST SOME RANDOM OBSERVATIONS...
1.) Relaying was enabled by the previous tech.
2.) Circular logging is enabled (I hope it doesn't crash)
3.) I may have to go through the entire exchange config to make sure this machine is correctly configured.
0
Alan HardistyCo-OwnerCommented:
Are you blacklisted?

www.mxtoolbox.com/blacklists.aspx

www.blacklistalert.org

If you are - which blacklists and what reasons are given (if any)?
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

tech911Author Commented:
Not yet.

I turned off the smtp service until we can get a handle on what is happening.  As soon as turn it on, the Queues fill up and you can here the hard drives chugging...

My guess is that the chugging is the mail being sent out.

I also turned on recipient filtering per your article, but the queues are either still filling up or trying to fulfill messages that are already in there.  I am going to try to clean up the queue per your link.

Will advise shortly
0
Alan HardistyCo-OwnerCommented:
Understood - but the important thing to know is who the senders of the messages are.  Once I know that - it will determine the action to take (postmaster / random senders not on your domain).
0
tech911Author Commented:
Great support on this issue.

Thanks.

It was an NDR attack, I followed your instructions and they worked as advertised.  The biggest issue was the cleanup.  There were 94,000 emails in the Queue trying to get out, it took all day to clean them out.

Thank you again, mass appreciation!
0
Alan HardistyCo-OwnerCommented:
Do you have any Anti-Spam software installed?  It doesn't sound like it.

I would recommend you trial www.vamsoft.com as it is brilliant and very nicely priced at $239 per server.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.