Exchange 2000 Problem

Win2k SBS SP4 with Exchange 2000 on a Dell Poweredge 1.7 GHz machine with 1.5GB of ram.

The Exchange set of services are not starting. I think that it has to do with the IIS admin service not starting. (And other exchange services being dependant on that service) When the server is started, I get 3 errors logged as the following:

Quote:

---

The configuration information of the performance library "C:\WINNT\system32\w3ctrs.dll" for the "W3SVC" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

The configuration information of the performance library "C:\WINNT\system32\infoctrs.dll" for the "InetInfo" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

The configuration information of the performance library "C:\WINNT\system32\aspperf.dll" for the "ASP" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

---

Now I started at the MS site and found the following on how to unregister and register the services again, but the symptoms in the KB article do not match mine.

KB Article: http://support.microsoft.com/default...b;EN-US;267831

MS says that you should unregister and the reregister the services to get it to not log the warning messages, which does not seem to be a fix to me.

These errors (in the application log) are followed by errors stating that all the exchange services could not start due to the IIS admin service not starting. (In the system log) Restarting the services obviously does not work. (I am using Remote Desktop to access the server remotely)

The only other thing I can think of is that the server just gave me a:

Dynamic registration or deregistration of one or more DNS records
failed because no DNS servers are available.
Event ID 5781
Source: Net logon

Any thoughts, questions, comments?

Edit: Also the Exchange System Attendant is the only thing that is "starting" when you boot.

Hi, what led to the restarting of services in the 1st place?

Do you have a backup of the metabase.bin file?

Or do you have acess to recent manual IIS config backups as provided in the IIS management
tool?
How about a system state backup?

Is this server also the AD server or is there another?

I don't use SBS but have never seen a non SBS setup care if IIS cold load or not to start the
Exchange Information Store at least regardless of IIS state.

I have used this article in the past to get similar problems going again..

May not apply to SBS tho...

http://support.microsoft.com/default...oduct=exch2003

This is a friends company (Small Business) and I dont know the state of their backups. I will ask what they have backed up.

This is the only server in the network and Active Directory is installed.

Thanks, I will check out the link.

Edit: The server was frozen in the morning and not serving email. Friend goes to the server to reboot it and it will not even login to the server. He hits the reboot switch and exchange does not start.

Another thing to look at is disk space.
Exchange services will not start if disk space is low on the drive where Exchange is installed.

Another thing I would look at but from your post, it seems your logging is running.
IF the event logging service is dead for some reason, Exchange will not start if the event
logger is not starting.

Happy to help look if you get more info..

Space should not be a problem. The drive is partitioned into 2 partitions. 10-12GB (I believe) for the C drive and 70GB for the other drive that houses exchange.

The first drive has 2GB free and the second drive has 30 GB free. (Also used as a fileshare for the office)

Exchange logging is logging SMTP traffic because some bastard was sending out a lot of email through their server.

I will be in front of the machine in about 3 hours. If I dont get another suggestion, I am going to try and backup and restore exchange.

See if you can try re applying the Exchange and Server service packs...

Has worked for me when I have problems with Exchange 2K.

Does the server have Internet access...is it working...I have seen exchange throw a fit if it cant find a DNS server???

Also stop any AV from scanning the M:\ drive...it a virtual drive and you can corrupt your exchange by scanning it with 3rd party utilities

HTHs

MLF
EDIT

After you do that...reboot and run the Internet Connection wizard ( just saw the SBS beside your post)...this resets your local and internet connections

No antivirus running. (Another bone I have to pick with him) I am doing a remote desktop into the machine, so I assume (and I could be wrong) that they are not having internet access problems. SBS uses ISA server as a firewall/proxy, so that could be another issue.

Thanks for the ideas. I may backup everything and try reapplying the SP.

CXGJAROD

Is there an online backup being done...if not the log files do not get cleared

Exchange on the SBS has a 16gig limit....

I have had the same problem with SBS 2k and the exchange SP 2 ( I believe) brings it back to life....but reapply all SPs...then run the internet connection wizard...although it stops and starts all related services.....so you may lose your TS connection. :)


MLF

They have setup a backup to an Iomega rev drive. I dont know if it has ran yet or not. It was supposed to run a 1am everynight, but it was mentioned that they might of had a problem with it. There are 650 MB of Exchange logs currently on the server. (Just the SMTP logs) I will take out the backup drive just in case that could be an issue. (When I get to their office)

Excellent site for troubleshooting the MS Small Business Server

http://www.smallbizserver.net/Default.aspx?tabid=53



MLF

One more thing. I think that the Exchange share is gone. (M Drive) Just noticed it. Dont know where it went. Ethier its gone or I cannot see it through remote desktop.

One little known fact for retail versions of the SBS.....It includes 2 FREE support calls to MS seeing the product was so unstable in the 4.X days...

This does not apply to SBS 2003....but may still be available for the 2000 product.

Quote:

---

Originally posted here by morganlefay
One little known fact for retail versions of the SBS.....It includes 2 FREE support calls to MS seeing the product was so unstable in the 4.X days...

This does not apply to SBS 2003....but may still be available for the 2000 product.

---

The support calls are gone. The last consultant they had used them. Good thing I have AO.

2 things since he was having a lot of mail going through. Check the badmail folder. That thing will fill with hundred of thousands of small files that takes windows to it's knees and thus exchange. Use the cmd line since winows chokes. Delete everything in the folder. I moved mine to another drive so it's mailroot/badmail. Next check his log files under \exchange logs and if there is more than a few the backup is failing or he is not doing it properly. Run windows backup on it and output the file to the other large partition. Do not reinstall anything until that is done and looks good. ;) I would bet the \mailroot\badmail folder is dogging down the system and exchange cannot start because the virtual drive M: is taking too long to start? The system -if it comes back - will be slow while the message ques are cleared, assuming that is the problem but it's a good place to start.

2 gb is not much. Even a small shop will have a 3 or 4 gb mail store. It should be moved (or checked to see where it exists) to the other much larger drive. Exchange does not do that by default. Everything get's dumped into the first partition. I am only guess but I have seen this too common lately. Especially with spammers getting access to mail boxes through WEAK domain passwords.

\\EDIT M will NOT be there if the service fails to start.

\\EDIT

Quote:

---

There are 650 MB of Exchange logs currently on the server. (Just the SMTP logs) I will take out the backup drive just in case that could be an issue. (When I get to their office)

---

Just to eliminate that run ms backup on the information store and just save it to another partition and get the tape running later if time is critical.

Roadclosed: The exchange install is on the bigger partition. Only Windows and some select other installs are on the first partition.

Also, I think that the spammer was using a legitimate account (The CEO's) to send large amounts of email. Every password on the domain has been changed and the outbound traffic has slowed to a normal size.

Good, delete the bad mail folder and make sure the information store and bad mail are on the partition, just to be safe. Even with alot of space the lack of good backups may have corrupted the store, it's common OR the badmail folder is too large to parse properly.

//EDIT chances are excellent that the user account was easily compromise, glad you changed the passwords but if they are easy they will get back in, good SMTP logging for a few days will ID the culprit as he tries more user aco****s.

Quote:

---

Originally posted here by RoadClosed
2 things since he was having a lot of mail going through. Check the badmail folder. That thing will fill with hundred of thousands of small files that takes windows to it's knees and thus exchange.

---

I run a bat file with the following on exchange machines every couple of days...

cd <install drive>:\exchsrvr\Mailroot\vsi 1\BadMail <--- or wherever badmail resides
del *.* /Q

Just an FYI


The remove and re-install iis/exchange might be your ticket here...I would try sp3 1st tho
Would scare the CRAP out of me without a good information store backup tho.
If you don't have that, can you image the drive 1st just in case?
If you dont' have image software, I'll throw you a trial version to use if you want..

I do that as well Chef, it's amazing MS didn't design a decent way to delete the badmail folder. I don't think they anticipated the audacity and cunning of spammers. :mad: If the server is compormised the bad mail folder will reach dangerous proportions in a few days or hours in rare circumstances.

\Edit there are some utils that could attempt to restore the info store depending on your time and the data worth saving.

Quote:

---

Originally posted here by RoadClosed
\Edit there are some utils that could attempt to restore the info store depending on your time and the data worth saving.

---

I will try the badmail folder. As I like to keep the options open, can you point me in the right direction Road Closed? The data is worth saving. They were complaining because all of their calendar info is in Exchange. It is probably worth it to them.

just do a search for bad mail and make sure it comes up as a subdirectory under \mail root. You can delete this with only a small risk of losing critical data. Most of it will be spam but a few may be actual messages waiting to be delivered. I am looking in exchange but you can just search.

//EDIT In system manager expand your server then protocols. Right click the default smtp virtual server and click propterties. The location is in the message tab. Right clicking the properties of the exchange server will divulge location of the logs and database as well. The should all be on the larger drive. After you delete bad mail run MS backup on the inforamtion store. If there are NO errors in the log then you should have a good store. Reboot and try again with both log files and bad mail cleared.

Sorry. I knew where the badmail was stored, but I was referring to this comment.

"\Edit there are some utils that could attempt to restore the info store depending on your time and the data worth saving. "

Wht utils are there to attempt a restore on the info store if it is messed up?

Quote:

---

Originally posted here by CXGJarrod
I will try the badmail folder. As I like to keep the options open, can you point me in the right direction Road Closed? The data is worth saving. They were complaining because all of their calendar info is in Exchange. It is probably worth it to them.

---

If the databases are corrupted, you will probably still be able to start Exchange services.
The problem would arise when trying to mount the databases.

MDBDATA\priv.edb is the private information store database
MDBDATA\priv.stm is the private information store database index
keep both together

If this is what you were talking about...??

the pub.edb and pub.stm are the public folder information

If you want to do a corruption check on the databases, check out ESEUTIL
If you want to run this tool, get some beer and a comfy chair...can take hours
Also remember ESEUTIL will require free disk space = to the size of the information store to
run correctly.

Doh! Sorry... Try the backup, I am looking for them. To my knowledge a succesful exchange backup will verify the integrity of the data sore? You understand that backing up exchange verifies and writes the logs to the actuall database? It is much more than just backing up data. It's also a database manager.

Quote:

---

Originally posted here by RoadClosed
Doh! Sorry... Try the backup, I am looking for them. To my knowledge a succesful exchange backup will verify the integrity of the data sore? You understand that backing up exchange verifies and writes the logs to the actuall database? It is much more than just backing up data. It's also a database manager.

---

Ok. As we dont have exchange here at work and so I am not an exchange admin (just trying to help out the friend) I should try something like this correct?

http://support.microsoft.com/default...192185&sd=tech

I should try wiping out the Badmail, (if this does not work) then the ESEUTIL backup and degfragment (if this does not work), then SP3 and finally burn the server/chuck it out the window? (if this does not work) Or reinstall? This is going to cost him a lot of beer. ;)

CXG:

Couple of things bother me about this scenario.....

1. RDP is Terminal Services with a new name... ;) . I manage my mailserver all the time through terminal sevices and I can read mail and everything through TS. So if the M: drive isn't there, then it isn't mounting or it isn't mounting properly. Just to be sure I fired up the VPN and WinXP RDP'ed to it.... The M: drive is sat there fat, dumb and happy.

2. You say that it only has a 2G store but you say you have 650Mb of smtp logs... How log has this server been up and have you ever just archived them. I get about 2-6Mb a day with a store that is almost 12G. The are logs for over a year zipped up and there are the plain text files from 04/01/04 totalling 322Mb. So if your logs are that big with such a small store I would look at the logs more carefully.... Is it being used as a spam server? OTOH, do you have a spam filter prior to the Exchange server there... If not then the logs may be bigger... I know my spam server stops 50ish% of mail from reaching my exchange server.... But it's a thought. Unless knowledge of what mail went where and when I would suggest that you delete them once they are older than a couple of months. There's not a lot of point keeping them after that unless it is important to be able to confirm or deny the send or receipt of mail at the server level.

One final note that is most probably unrelated but it's worth a mention and a question.....

Did anyone, anywhere experience Exchange 2000 issues this weekend..... here's the suspicious fart coming out in me..... We had issues related to the SCSI array on our exchange server this weekend, (sunday specifically), that brought down the store and required 2 cold reboots to have it come back up..... The array checked out as good after the second reboot and all the drives tested good per the manufacturers testing software..... The event logs indicate that the array failed but the smtp server continued to run until it could no longer delay writes to the array at which point, (presumably at the arrival of the next mail), it flushed the delayed write cache, wrote the "data is lost" message to the event log and continued to accept SMTP mail for a second time... It was noticed by one of my employees when he arrived at 6:30am today.... I see it as "odd"..... Since OWA operates off this server it is open to the public network..... I don't like odd...... Anyone else seeing _odd_ things on Exchange 2000 servers this weekend?

delete the bad mail but run the backup first before ESE. Run ESE only if that fails. Look at the backup log windows spits out and if there are no errors then it's most likely not a information store issue. I am hoping it starts after those steps. :)

//EDIT Tiger my firwwall was HOT, I mean real HOT all weekend. I don't use OWA but I thing something was going on. I only have port 25 open so I am not a normal target outside mail, so something was out there?

Quote:

---

Originally posted here by Tiger Shark
CXG:

Couple of things bother me about this scenario.....

1. RDP is Terminal Services with a new name... ;) . I manage my mailserver all the time through terminal sevices and I can read mail and everything through TS. So if the M: drive isn't there, then it isn't mounting or it isn't mounting properly. Just to be sure I fired up the VPN and WinXP RDP'ed to it.... The M: drive is sat there fat, dumb and happy.

2. You say that it only has a 2G store but you say you have 650Mb of smtp logs... How log has this server been up and have you ever just archived them. I get about 2-6Mb a day with a store that is almost 12G. The are logs for over a year zipped up and there are the plain text files from 04/01/04 totalling 322Mb. So if your logs are that big with such a small store I would look at the logs more carefully.... Is it being used as a spam server? OTOH, do you have a spam filter prior to the Exchange server there... If not then the logs may be bigger... I know my spam server stops 50ish% of mail from reaching my exchange server.... But it's a thought. Unless knowledge of what mail went where and when I would suggest that you delete them once they are older than a couple of months. There's not a lot of point keeping them after that unless it is important to be able to confirm or deny the send or receipt of mail at the server level.

One final note that is most probably unrelated but it's worth a mention and a question.....

Did anyone, anywhere experience Exchange 2000 issues this weekend..... here's the suspicious fart coming out in me..... We had issues related to the SCSI array on our exchange server this weekend, (sunday specifically), that brought down the store and required 2 cold reboots to have it come back up..... The array checked out as good after the second reboot and all the drives tested good per the manufacturers testing software..... The event logs indicate that the array failed but the smtp server continued to run until it could no longer delay writes to the array at which point, (presumably at the arrival of the next mail), it flushed the delayed write cache, wrote the "data is lost" message to the event log and continued to accept SMTP mail for a second time... It was noticed by one of my employees when he arrived at 6:30am today.... I see it as "odd"..... Since OWA operates off this server it is open to the public network..... I don't like odd...... Anyone else seeing _odd_ things on Exchange 2000 servers this weekend?

---

All the issues with this system started sometime this weekend.

2) It was a guess on the log files, but it puts out 1 18.9MB log file (just SMTP logging) each day. I thought that was a bit big, but as I said I am not an exchange admin and didnt know what was big. I am not sure how big the database store is, but the drive it is located on has 30GB free.

Gotta get going out there, but I will check up on this thread once I get out there.

That smtp log will tell you alot. In addition in event viewer, event ids 1706 - 1707 - 1708 are most likely compromised signs. You must have smtp loggin turned on to get them.

Good luck, I'll drink one for ya.

Quote:

---

but it puts out 1 18.9MB log file (just SMTP logging) each day.

---

This is plain SMTPSVC logging... right? That's a _TON_ on a daily basis!!!

My logging under M$ Basic logging captures 5, but sometimes 6, transactions per email, (HELO, MAIL FROM, RCPT TO, DATA, QUIT). If you are capturing the data too then I would sugest that unless there is a need, turn that off.... Your just causing your own problems in disk space alone.... Forget to clean it for a week or three and watch the server drop on you....

Outside what I am saying listen to RoadClosed.... He has a better grip of the server itself than I do.... I have an employee manage it.... He's much better at it than I am...... :D

Looks like the spammers have gotten back in. Over 8000 messages in the D:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue and almost 20,000 objects in the badmail folder. This might take a while.

Moving the messages out of the queue for further analysis, but I believe that we just saved 8000 people from learning how to increase the size of their package. Now I just need to find out how they are getting in. I ran some open relay tests a while ago and they came up negative.

Edit: Ok. Now this is looking like a paying job. He wants to setup some security and kick this spammers @ss. Where is a good place to start looking for this spammer?

Edit2: The server was backup after clearing the badmail and queue

This article may help clear up your smtp queues

http://support.microsoft.com/?kbid=324958

You may also want to turn off NDRs

MLF

All clean. I just need to read up and figure out how the heck they are getting in...

BTW: I already went through the instructions listed above. (The relaying part)

Looking through the logs it seems they hit between 5 and 8am PST. (For the past couple of days) The weird thing is that the IP address has not been reported to any spam lists yet. It probably sends out a good deal of email. I will check in the morning.

First questions are:-

1. Fully Patched including Exchange 2000 updates?
2. Other publicly available services this server runs?
3. Properly firewalled? (check it remotely - every port).
4. DMZed? ('Cos if it isn't the trusted network may be compromised).

You might want to run this over it first.... It tries a few "creative" attempts to force a relay.

Quote:

---

Originally posted here by Tiger Shark

4. DMZed? ('Cos if it isn't the trusted network may be compromised).

---

Good point..
Machine inside could be the sender.

Does anyone access via VPN? Could be another place to look.

What are your relay settings?

Most spammers get in via authenticated user accounts assuming you have NOT ran the IIS lockdown tool on Exchange and ensured all forwarding options are turned off. It's tough to prove if it's inside or out but at high volume my guess is outside automated bot. The network accounts are the SAME as the accounts presented on the outside. Meaning if user bob has a password of bullet to access the network then a bot could get relay capability on the exchange server by guessing “bullet”. Not difficult at all. In fact you will see it come back now and try things common like administrator, guest etc. Funny to watch. In addition if the mail accounts were merged from an older system or propagated via active directory then all those bogus unused accounts will appear on the exchange server public side. You can prevent some of that BS by turning forwarding off completely; it is not a default setting in 2000.

lol, Tiger I am no expert what was it you said in another thread I often stare at the screen and mutter “do I know wtf I am doing?” BUT I have recovered from many complete disasters and never had to restore a backup. Knocks on wood. I too had an employee running exchange; she was terminated after crash number 3. I have since had crash number 4 – backups appending to a hard disk versus overwriting and the FTP script failing to copy them off. Hard disk space is critical and exchange gives very little indication that there are issues. It just likes to run right into the brick wall at full speed.

I am glad the information store was not corrupted, I had some faith it would come back after clearing all the crap out. :) BTW your mail queues will continue to fill up because chances are there are still outlaying messages waiting to be sent and the queue time is large. Make sure this guy watches and clears all bad mail and queues. In addition I would not allow remote access of ANY kind on the public card/IP. Put it in a DMZ or stick another NIC in there for private access if it’s necessary or encrypt it. Tiger has a good solution I will implement soon, GFI Mail Guard I think? But if you only open port 25 and sniff it you should be ok, but a complete compromise of the mail server will open the network. If you don’t want to spend money or keep your cost down and pass on some good profit you can build a small linux mail forwarder. It won’t strip bad stuff like GFI but you can run it on an old box and it won’t cost much. Just google a howto linux smtp forwarder or relay.

Now on the client side that’s tougher. If you have SMTP logging enabled you can look for those event ids I listed earlier. I don’t think you will find them posted anywhere but I know for fact that those are indications of external authentication on the SMTP virtual servers. Oh, Also don’t forget to enable security monitoring for this server on the domain controller. There is no way to stop internal spamming unless your client has implemented desktop virus protection to stop the bots on outlook and you lock down spy ware somehow. Even in a system locked pretty tight you will see large volumes of bad mail but at least you can stop the malicious content. It’s hard to stop all those people wanting to play “chain letter mamma” mailing crap to their entire address book but routinely deleting that bad mail folder and setting the queues times back from a couple of days to a few hours is a small risk but easier on the system. I think the default settings are a couple of days for exchange to deliver mail. I say, if it’s not there in something like 7-10 hours - move it to bad mail and delete it. I average about 1000 undeliverable messages each day. That will add up and like Tiger said, on an active exchange server if you do not clear out those items along with logs it will fail within weeks.

Quote:

---

Originally posted here by Tiger Shark
First questions are:-

1. Fully Patched including Exchange 2000 updates?
2. Other publicly available services this server runs?
3. Properly firewalled? (check it remotely - every port).
4. DMZed? ('Cos if it isn't the trusted network may be compromised).

You might want to run this over it first.... It tries a few "creative" attempts to force a relay.

---

Good points.

1) Fully patched as far as the OS goes, but I am not sure about Exchange. I will check on that.
2) It runs Outlook Web Access and Remote Desktop. It does not run the companies website. (Hosted at yahoo) As far as I know that is all that is running.
3) Small Business Server comes with ISA server installed on it, so it does have a software firewall. However, a quick port scan from GRC.com shows the following ports open:
25, 80, 88, 110, 111, 119, 135, 139, 143, 389, 464, 443, 548, 563, 593, 636, 691, 993, 995, 1026, 1029, 1033.
4) Its not DMZed. Its has all their files on that one machine.

I ran the abuse.net test a while ago and it came up negative, however it came up positive this time around.

Quote:

---

Mail relay testing
Connecting to 66.27. for anonymous test ...
&lt;&lt;&lt; 220 server.domain.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.6713 ready at Wed, 8 Sep 2004 07:45:22 -0700
&gt;&gt;&gt; HELO www.abuse.net
&lt;&lt;&lt; 250 server.domain.com Hello [208.31.42.77]

Relay test 1
&gt;&gt;&gt; RSET
&lt;&lt;&lt; 250 2.0.0 Resetting
&gt;&gt;&gt; MAIL FROM:&lt;[email protected]&gt;
&lt;&lt;&lt; 250 2.1.0 [email protected]....Sender OK
&gt;&gt;&gt; RCPT TO:&lt;[email protected]&gt;
&lt;&lt;&lt; 550 5.7.1 Unable to relay for [email protected]

Relay test 2
&gt;&gt;&gt; RSET
&lt;&lt;&lt; 250 2.0.0 Resetting
&gt;&gt;&gt; MAIL FROM:&lt;spamtest&gt;
&lt;&lt;&lt; 250 2.1.0 [email protected]....Sender OK
&gt;&gt;&gt; RCPT TO:&lt;[email protected]&gt;
&lt;&lt;&lt; 550 5.7.1 Unable to relay for [email protected]

Relay test 3
&gt;&gt;&gt; RSET
&lt;&lt;&lt; 250 2.0.0 Resetting
&gt;&gt;&gt; MAIL FROM:&lt;&gt;
&lt;&lt;&lt; 250 2.1.0 &lt;&gt;....Sender OK
&gt;&gt;&gt; RCPT TO:&lt;[email protected]&gt;
&lt;&lt;&lt; 550 5.7.1 Unable to relay for [email protected]

Relay test 4
&gt;&gt;&gt; RSET
&lt;&lt;&lt; 250 2.0.0 Resetting
&gt;&gt;&gt; MAIL FROM:&lt;spamtest@[66.27.]&gt;
&lt;&lt;&lt; 250 2.1.0 spamtest@[66.27.]....Sender OK
&gt;&gt;&gt; RCPT TO:&lt;[email protected]&gt;
&lt;&lt;&lt; 550 5.7.1 Unable to relay for [email protected]

Relay test 5
&gt;&gt;&gt; RSET
&lt;&lt;&lt; 250 2.0.0 Resetting
&gt;&gt;&gt; MAIL FROM:&lt;[email protected]&gt;
&lt;&lt;&lt; 250 2.1.0 [email protected]....Sender OK
&gt;&gt;&gt; RCPT TO:&lt;[email protected]&gt;
&lt;&lt;&lt; 550 5.7.1 Unable to relay for [email protected]

Relay test 6
&gt;&gt;&gt; RSET
&lt;&lt;&lt; 250 2.0.0 Resetting
&gt;&gt;&gt; MAIL FROM:&lt;spamtest@[66.27.]&gt;
&lt;&lt;&lt; 250 2.1.0 spamtest@[66.27.]....Sender OK
&gt;&gt;&gt; RCPT TO:&lt;securitytest%abuse.net@[66.27.]&gt;
&lt;&lt;&lt; 550 5.7.1 Unable to relay for securitytest%abuse.net@[66.27.]

Relay test 7
&gt;&gt;&gt; RSET
&lt;&lt;&lt; 250 2.0.0 Resetting
&gt;&gt;&gt; MAIL FROM:&lt;spamtest@[66.27.]&gt;
&lt;&lt;&lt; 250 2.1.0 spamtest@[66.27.]....Sender OK
&gt;&gt;&gt; RCPT TO:&lt;securitytest%[email protected]&gt;
&lt;&lt;&lt; 250 2.1.5 securitytest%[email protected]

Relay test result
Hmmn, at first glance, host appeared to accept a message for relay.
THIS MAY OR MAY NOT MEAN THAT IT'S AN OPEN RELAY.

Some systems appear to accept relay mail, but then reject messages internally rather than delivering them, but you cannot tell at this point whether the message will be relayed or not.

You cannot tell if it is really an open relay without sending a test message; this anonymous user test DID NOT send a test message.

---

Edit: Added a pic of the relay settings. They do have 2 or 3 external users so what are the best settings to use?

Quote:

---

25, 80, 88, 110, 111, 119, 135, 139, 143, 389, 464, 443, 548, 563, 593, 636, 691, 993, 995, 1026, 1029, 1033

---

*COUGH* Pwn3d

There's no firewall there if these ports are OPEN.... Though the lack of 445 interests me..... PM me with the IP will you..... I'll Nmap it for you and see what it really looks like....

Quote:

---

Relay test 7
&gt;&gt;&gt; RSET
&lt;&lt;&lt; 250 2.0.0 Resetting
&gt;&gt;&gt; MAIL FROM:&lt;spamtest@[66.27.]&gt;
&lt;&lt;&lt; 250 2.1.0 spamtest@[66.27.]....Sender OK
&gt;&gt;&gt; RCPT TO:&lt;securitytest%[email protected]&gt;
&lt;&lt;&lt; 250 2.1.5 securitytest%[email protected]

---

My Mail Sentry, (M$ SMTP), fails this one but it forwards it in to the Exchange server which fails it out.... I don't think this will be your problem. Try to do the same manually via telnet and actually send a message to an external account.

Quote:

---

Edit: Ok. Now this is looking like a paying job. He wants to setup some security and kick this spammers @ss. Where is a good place to start looking for this spammer?

---

Keep an eye for the emplyees too ;)...just to be safe. See if they got anything going on that might compromise the server. Any employees fired lately? Just some things to think about.

Quote:

---

Originally posted here by Cybr1d
Keep an eye for the emplyees too ;)...just to be safe. See if they got anything going on that might compromise the server. Any employees fired lately? Just some things to think about.

---

I dont think that any employees have been fired recently, but when I was out I deleted all the Active Directory accounts (and mailboxes) of those employees that were not working for the company anymore. All passwords were changed a week ago as well.

Ouch..... Not a "pretty" sight.....

Quote:

---

Starting nmap V. 3.00 ( www.insecure.org/nmap )
Interesting ports on (xxx.xxx.xxx.xxx):
(The 1570 ports scanned but not shown below are in state: closed)
Port State Service
25/tcp open smtp
80/tcp open http
88/tcp open kerberos-sec
110/tcp open pop-3
111/tcp open sunrpc
119/tcp open nntp
135/tcp filtered loc-srv
139/tcp open netbios-ssn
143/tcp open imap2
389/tcp open ldap
443/tcp open https
445/tcp filtered microsoft-ds
464/tcp open kpasswd5
548/tcp open afpovertcp
563/tcp open snews
593/tcp filtered http-rpc-epmap
636/tcp open ldapssl
691/tcp open resvc
993/tcp open imaps
995/tcp open pop3s
1026/tcp open LSA-or-nterm
1029/tcp open ms-lsa
1033/tcp open netinfo
1720/tcp open H.323/Q.931
3005/tcp open deslogin
3052/tcp open PowerChute
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3372/tcp open msdtc
3389/tcp open ms-term-serv
4444/tcp filtered krb524
Remote operating system guess: Windows Millennium Edition (Me), Win 2000, or WinXP
Nmap run completed -- 1 IP address (1 host up) scanned in 142 seconds

---

That ISA server is either not running or misconfigured......

Seriously... A firewall is in order IMO. It looks like you simply have the box out there on the public net with all the services required to run an AD controller let alone an exchange server on a trusted network..... You even have the global Catalog ports available...... I wouldn't be surprised if I couldn't join my laptop to your domain with a little effort.....

First thing I would suggest is down the box...... Painful I know..... But show the owner this message and if he isn't conviced ask here for second opinions about how quickly this box could be compromised. Then get a firewall up.... Hell a linksys would do to start.... If this is a small business I would look towards a WatchGuard SOHO but you may have to wait a few days for that... the linksys is a drive to your local CompUSA away......