Mail Exchange Server - Big trouble - Please help!

Quote from menace33 : The IP range would be 189.96.0.0/11

Why /11 and not, say /16 based on the first two octets?

Also, I found out that the files have been renamed. pub.edb to pub1.edb, and priv.edb to priv1.edb

File sizes are: pub1.edb 19,464 KB, priv1.edb 7,026,440 both these files were changed at 6:48 pm.

At this time, I updated the server and restarted. Do you think update screwed up?

Seriously? You have a corporate machine (possibly network) that been hacked. The first thing you should do is to pull that machine off of the network completely. Set up a new machine to take its place and CAREFULLY move just the data from the old mail server to the new. If that is not in your budget, get a new hard drive (or drives) and pull the old compromised ones. Then depending on what else you deem necessary, do the necessary post-mortem on the drive. You need to figure out how they got in and what you can do to prevent it from happening again. That is part of your duties as an IT Admin. After all of that is said and done either totally wipe the hard drive and reformat it or destroy it.

Quote from vivahate : Why /11 and not, say /16 based on the first two octets?

I'm a bit more on the cautious side. /11 metric takes out that whole ISP range. Unless pokey feels he is going to be doing business with that Brazilian ISP then this leaves no room for the outside threat from getting in by VPN, proxy, or direct ISP connection through that Brazilian ISP. Hell there may be several VPN servers and proxies along that ISP they could jump to outside of the 180.106.80.0/16 range but still with that ISP so I tend to be a little more comprehensive with my blocks and if I have to open up ranges thereafter, then so be it.

Quote from menace33 : I'm a bit more on the cautious side. /11 metric takes out that whole ISP range. Unless pokey feels he is going to be doing business with that Brazilian ISP then this leaves no room for the outside threat from getting in by VPN, proxy, or direct ISP connection through that Brazilian ISP. Hell there may be several VPN servers and proxies along that ISP they could jump to outside of the 180.106.80.0/16 range but still with that ISP so I tend to be a little more comprehensive with my blocks and if I have to open up ranges thereafter, then so be it.

ahh.. ISP range. Thanks

How do I block this in tomoto? Script please... Thanks.

Quote from pokymon : How do I block this in tomoto? Script please... Thanks.

What? you have a corporate email server behind a consumer router???

Quote from pokymon : I am using Tomato. How do I block this? I don't know to use the script. Thanks.

Oh, I figured you were just behind some hardware firewall like a Cisco router (not the Cisco-Linksys home variety). I was making mention of setting up an access rule and block any attempts from that IP range from getting to your network.

I do not know of how to set up an access rule for a Tomato firmware router. From what all I can see, you can block internal users from getting to internet sites and URLs, but not block outside users specifically as in an access rule.

Quote from pokymon : How do I block this in tomoto? Script please... Thanks.

What?? you have a corporate email server behind a consumer grade "router"???

I guess thats why you havent looked into the firewall logs?

Should their be any consumer private data on that email server you could/should/will get sued due

Edit disregard. new posts were not showing up on my computer under all 3 browsers

Quote from nizzy1115 : What?? you have a corporate email server behind a consumer grade "router"??? I guess thats why you havent looked into the firewall logs? Should their be any consumer private data on that email server you could/should/will get sued due

I have a small business and not a corporation - just 5 emails that's it.

Quote from pokymon : I have a small business and not a corporation - just 5 emails that's it.

Still no excuse - the company could still be sued if customer info got out. Are you prepared to deal with that? Tomato should be able to send logs to an internal machine. You should enable that immediately if you have not been doing so. If you want to take a shortcut and use Tomato there are still things you can do to make it better.

If you are under budget constraints (most small businesses are) you can use the community version of smoothwall on an old PC with 2 network cards and have much better protection than you do right now. Please consider it.

My mistake. priv1.edb is a backup file and don't think anyone changed it. It appears to me update screwed up last night.

Guys, all good. There was no hack or anything. I did an MS updated last night, and one of the services didn't start. Sorry guys.