Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 603
  • Last Modified:

exchange 2003 random internal e-mail addresses in outgoing queue

Hey guys,

My client is running Exchange 2003 SBS (i just took them on). Their outgoing exchange queues are hacked with RANDOM internal e-mail addresses (xyaj38s@company.com).

I've enabled sender/recipient filtering, ensured it's not an open relay, scanned the server for viruses (did find a backdoor trojan on it, i believe it's removed). I also changed everyone's passwords... Turned off windows authentication.

The queues are still filling up. Is it possible someone's machine in the office is compromised?

Anything else I should look at?

Thanks guys.
0
tamaneri
Asked:
tamaneri
3 Solutions
 
Glen KnightCommented:
Looks like you've done most of everything else.  I'd say the next place to look is definitely the client machines.
0
 
jbvernejCommented:
Hello,

Your messages in queues:
does they seem to be fake NDR messages (Non Delivery Report)  ?
(IE a NDR for a message that was never send ) ?
If yes, you could be under External NDR attack.

here a  procedure to cleanup:
kb886208 - Exchange queues fill with many non-delivery reports from the postmaster account in Small Business Server 2003
http://support.microsoft.com/kb/886208/en-us
0
 
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
Restart the services or the server and check.

- Rancy
0
 
tamaneriAuthor Commented:
Thanks for the input guys.

Turns out it was a root-kit on the server itself. I ran the following programs to remove all of the malware/viruses/rootkit

1) MBAM
2) TDSS Killer
3) Kaspersky Virus Removal Tool (just to ensure it was clean).

The virus/root-kit that TDSSKILLER found was a file called sbscrexe.exe in c:\windows\system32.

Thanks for your help in this matter. Queues look like they're going to remain clean.
0
 
tamaneriAuthor Commented:
Just to update you guys... It took a couple of hours, but I have some more messages in the queues. I didn't have much time to spend looking at the client machines while I was on site today. I've instructed them to turn off their computers when they leave for the day so I can determine if it's a server-related hacking issue, or a desktop virus/malware causing the problem.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now