HELP!! I think I've been hacked! Server down!!!

[SelbyGlenn]

hi there,

running Exchange 2000 on Win2k Server (sp4)
event logs full of ID 2104
RPC service has failed.
Net command is not recognised! (cannot start/stop services)
No internal or external email!
1000 users on my back!
AAGGHHHHH!!!!!

Any ideas??

Thanks in advance....

Glenn
BEng MCSE CCA

 

[darren97]

What have you done to start troubleshooting this so far Glenn? Have there been any changes made recently? I take it you've rebooted

 

[SelbyGlenn]

I've rebooted but it still failed. It says the RPC service is not responding yet the service says its started in the services applet. I've restarted the service and it looks like it restarts fine but the problem persists. I've looked up the event log error and it mentions the PDC not being available. All DC's are running fine. all other servers are ok. I might have to consider rebuilding soon if I can't get any where....

Glenn
BEng MCSE CCA

 

[darren97]

Ok, so you've tried restarting the rpc service using net start rpcss. That doesn't seem to help, right? I take it you can't ping a fqdn from the exch box, what about pinging an ip address from the exch box? You've probably already checked the physical side eg, dodgy nic etc.
The other possibility is that its a virus

 

[SelbyGlenn]

Pinging is fine. I can even terminal server to it! I can run computer management from my PC and attach to the server too. It's all very strange. Sohpos is running on the server and I have just finised scanning it and all is clear....

Glenn
BEng MCSE CCA

 

[motty123]

We had a problem caused by sophos AV mailmonitor. in our case users could open outlook but couldnt actually open the emails. Outlook would freeze. We had to actually uninstall Sophos, just stopping the services didnt help. Once this was done all returned to normal. Might be worth a try, although symptoms are different. (Usual warnings about backing everything up etc.)

 

[SelbyGlenn]

it's worth a try. I will remove Sophos....

Glenn
BEng MCSE CCA

 

[tmt7734]

Make sure your antivirus softwre didn't delete or quaretine the exchange log files