Solved

exchange 2003 random internal e-mail addresses in outgoing queue

Posted on 2013-06-24
5
529 Views
Last Modified: 2013-06-24
Hey guys,

My client is running Exchange 2003 SBS (i just took them on). Their outgoing exchange queues are hacked with RANDOM internal e-mail addresses (xyaj38s@company.com).

I've enabled sender/recipient filtering, ensured it's not an open relay, scanned the server for viruses (did find a backdoor trojan on it, i believe it's removed). I also changed everyone's passwords... Turned off windows authentication.

The queues are still filling up. Is it possible someone's machine in the office is compromised?

Anything else I should look at?

Thanks guys.
0
Comment
Question by:tamaneri
5 Comments
 
LVL 74

Accepted Solution

by:
Glen Knight earned 167 total points
ID: 39271769
Looks like you've done most of everything else.  I'd say the next place to look is definitely the client machines.
0
 
LVL 8

Assisted Solution

by:jbvernej
jbvernej earned 167 total points
ID: 39271825
Hello,

Your messages in queues:
does they seem to be fake NDR messages (Non Delivery Report)  ?
(IE a NDR for a message that was never send ) ?
If yes, you could be under External NDR attack.

here a  procedure to cleanup:
kb886208 - Exchange queues fill with many non-delivery reports from the postmaster account in Small Business Server 2003
http://support.microsoft.com/kb/886208/en-us
0
 
LVL 52

Assisted Solution

by:Manpreet SIngh Khatra
Manpreet SIngh Khatra earned 166 total points
ID: 39271841
Restart the services or the server and check.

- Rancy
0
 
LVL 3

Author Closing Comment

by:tamaneri
ID: 39272513
Thanks for the input guys.

Turns out it was a root-kit on the server itself. I ran the following programs to remove all of the malware/viruses/rootkit

1) MBAM
2) TDSS Killer
3) Kaspersky Virus Removal Tool (just to ensure it was clean).

The virus/root-kit that TDSSKILLER found was a file called sbscrexe.exe in c:\windows\system32.

Thanks for your help in this matter. Queues look like they're going to remain clean.
0
 
LVL 3

Author Comment

by:tamaneri
ID: 39272948
Just to update you guys... It took a couple of hours, but I have some more messages in the queues. I didn't have much time to spend looking at the client machines while I was on site today. I've instructed them to turn off their computers when they leave for the day so I can determine if it's a server-related hacking issue, or a desktop virus/malware causing the problem.
0

Featured Post

Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

Join & Write a Comment

Suggested Solutions

Resolve Outlook connectivity issues after moving mailbox to new Exchange 2016 server
Easy CSR creation in Exchange 2007,2010 and 2013
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now