Mail Exchange Server - Big trouble - Please help!

Our exchange server was running for several years, this morning it's stop working.

Under First Administrative Group: SMTP > Default SMT Virtual Server > Current Sessions > USER: VERNEZA08 IP 189-106.80.33 is there and I can't remove it.

Moreover, I can't find folders under Mailbox store and public folders storage.

I had SSL certificate and deleted too.

What exactly happened?

Thanks.

umm it sounds like you are hacked? id kill its connection to the outside world and work from there.

Are you an IT administrator?

Quote from nizzy1115 : umm it sounds like you are hacked? id kill its connection to the outside world and work from there. Are you an IT administrator?

Yes. I am an administrator. Event Viewer shows: Failed audit. I disabled port on my router and audit is stopped now. What should I do?

Honestly I'm a lotus notes email admin (please dont laugh) so my help would be less what someone else could offer.

Id start by auditing the pc checking logins etc. Who logged into the server and from where? check the firewall logs, are there a lot of incoming connections coming from one location? lots of telnet connections etc. First figure out where its coming from (if at all) and then work up on fixing the issues they caused. Changing admin passwords used on that server is a great idea too.

to kill that user what about stopping and starting smtp server?

Quote from nizzy1115 : to kill that user what about stopping and starting smtp server?

I did stop and start, and it's still not working. That user is gone. I have pretty long password with numbers, signs, letters, etc. How did they get in? What about certificate? Can I restore folders from the tape? I will be changing all user passwords.

Any mysterious accounts created on the server or domain? be scanning for malware while all this is going on too. If it is malicious and someones sending spam from your server you will get blacklisted fast and its a pain to get off it.

Quote from nizzy1115 : Any mysterious accounts created on the server or domain? be scanning for malware while all this is going on too. If it is malicious and someones sending spam from your server you will get blacklisted fast and its a pain to get off it.

I have Server 2003. What malaware software you recommend? Thanks.

Malwarebytes. Get that going asap. But also throw on your corporate antivirus whatever vendor you have mcafee/symantec etc.

Quote from nizzy1115 : Malwarebytes. Get that going asap. But also throw on your corporate antivirus whatever vendor you have mcafee/symantec etc.

I have ESET running 24/7 and it was catching some junk pretty well.

Thank you sir.

Malaware didn't find any spyware which is a good news. Now how do I restore folders to get going? I changed all user passwords.

Folders that have been deleted? I'd pull from your backups.

Its still strange that things went missing. Did you check for network intruders yet? How much logging do you have on the firewall level? Any IDS?

Alright, so you've got this user with the IP address of 189.106.80.33. This is a Brazilian IP address. Almost seems like they're trying to piggyback your SMTP server in order to spam. Why not ban the IP range for that user across your firewall so they cannot access any of your resources?

The IP range would be 189.96.0.0/11

Kick start your Exchange server and see how it goes?

Not just block it but trace it on the firewall is what I'm saying. See what else its doing.