I have inherited the responsibility of the care and feeding of a single Exchange 5.5 server that is running on a Window 2000 server that has not been patch since sp2. This server also has IIS 5 running on it as well. There are no other servers in the enterprise.
Because of the lack of critical patches this server is has been exploited through IIS 5 on numerous occasions. When the Email/Web admin left last month I inherited this mess. When this was dropped into my lap the server was rebooted approximately every 3 to 6 hours. I run Virus scans with AVG and found a Backdoor.sdbot in the inetpub directory. I ran scans using Trend Micros House Call, Network Associates Stringer and Bit Defender. Bit Defender found and Backdoor.RBot.RE.
I removed these viruses and decided that I would bring up a new Exchange 5.5 server that was completely patched in the same site. Have the directory replicated over to it. Then move the mailboxes. The system seemed stable until last Friday when I was going to shutdown the exchange services to do an offline backup in preparation for my plan. The services would not shutdown and I would get an “error 1053 service failed to stop in a timely fashion”. It turns out that this is not just happening with the exchange services but with all of the services on the server. I have rebooted to no avail. The event logs do not show anything out of the ordinary. The good news is that the Exchange services are still functioning an email is working like it should.
I figured that I could still bring the new exchange server up in the site. When I call the old admin to find out what the password is that the service agent uses he does not remember. I go to the connection properties in exchange to change to password and it hangs at 5%.
At this point I am going to bring up a new server in a new site and try to restore to it.
In have an offline backup from 06.13.05 and online backup from 06.24.05. I will be saving everyone’s pst file tonight.
My question is am I missing anything that will keep me from doing the restore to the new site?
Any insights will be appreciated.
JC
