|
jassyca -> RE: Lot's of connections on port 25 (20.Mar.2007 2:14:16 PM)
|
Did you ever find an answer for this problem? If not.. I want to make sure I've got this right. You are seeing a lot of connections from your server to its own port 25, yes? What tool did you use to see that? Also, do you have any antivirus software installed on your server? Since this is an Exchange server, I do want to mention that sometimes the AV that protects your users' mailboxes will not also protect the server, itself, from local attacks. Those are two different things, you see. So an AV scanner has two completely different types of things to scan or protect: mailboxes vs. local server. I know some admin's won't install a local AV because it can cause problems for Exchange if the AV tries to scan the MDBData directory(ies). But that can mean their mailboxes are protected yet the server is unprotected. Instead, to avoid problems, I believe most antivirus scanners have options so you can configure it such that will not scan your Exchange data directories (MDBData) and you also don't want it scanning the server's M: drive.
If your server is truly infected, you've got two options: 1 - scan the server with an antivirus scanner (with the scanner configured so it skips the above mentioned drives and directories) or, 2 - wipe the server and restore from backup. It's a heckuva lot easier to scan it with an AV than it is to restore the server from backup. Besides, unless you're exceedingly lucky and know exactly when it became infected, you don't know whether the backup is clean or infected too. And what's to stop a worm from immediately re-infecting your server two minutes after you're done with the restore, eh?
Once you've got your Exchange server running clean, the next thing you ought to start thinking about is: how did it become infected? Do you need to take a second look at your firewall rules? Did something sneak in that way? Or could there be a computer inside your network that brought the infection in? For instance, a laptop. Or maybe it got in through a desktop computer because someone using that desktop downloaded and installed something "cool" they found on the internet, not knowing it was infected.
Let us know what you find.
|
|
|
|