Exchange won't start, problems with the event viewer

Hi Everybody,

New problem of the day :-)

One of my customers server was hacked (I presume because we forgot to setup
SP4 for SQL Server -- the port was open to the outside world for business
purposes!). Anyways, the threat has been stoped (kind of trojan that setup a
SERV-U FTP server on port 21 which was also open!). Everything was cleaned
up one week ago and the server seemed to live again... but, today: new
problems!

Problem 1: Event Viewer going crazy! (since the trojan)
One of the problems, the oldest, is that the Event Viewer does not seem to
be updated with some events (e. g. when I get an error message on the
console which usually leads to an error event, there is none in the Event
Viewer) and also sends us regularly two alerts (from the Monitoring and
Reporting stuff of SBS) that have nothing realistic (backup error and
account lockout error when no backup is running and no account has been
locked!)

Problem 2: Exchange services not starting (getting critical... -- since
today!)
Suddenly, since today, the Exchange Services are not starting anymore. I get
the following error warning messages:
"Could not start the Microsoft Exchange System Attendant service on Local
Computer. Error 1075: The dependency service does not exist or has been
marked for deletion."
"Could not start the Microsoft Exchange Information Store service on Local
Computer. Error 1068: The dependency service or group failed to start."
(all services use "Local System Account" to Log On)

Problem 3: Dependencies are disabled! (severely embarassed! -- since today!)
The warning messages above are fine... but when I try to get to the
service's properties > dependencies, both the "This service depends on the
following system components" and "The following system components depend on
this service" boxes are disabled and contain an information ballon "<No
dependencies>" (also disabled).

There I am: Event Viewer going crazy, Exchange not starting and Dependencies
disabled. Is anyone having an idea of something to try before calling PSS?
If anybody has experience with PSS: can the solve this kind of case?

Thanks for your help folks,

Ambroise Nève -- Small Business Specialist (doh!)

Note: I've might have excellent belgian chocolate reward for usefull help
:-))))))))))


.

Relevant Pages

  • Re: Exchange wont start, problems with the event viewer
    ... Call PSS and ask for a Security review on this box. ... The trojan was running an FTP server on the same port which allowed us to find it out! ... Exchange depends on the Event Log, ... Problem 3: Dependencies are disabled! ...
    (microsoft.public.windows.server.sbs)
  • Re: windows xp home edition taking ages to boot up
    ... Spanner are you using the Live Comunications Server 2005? ... that in network connections you have 1 local area connection is that right. ... Description of Windows XP and Windows Server 2003 System ... You can access Event Viewer by selecting Start, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Exchange wont start, problems with the event viewer
    ... One of my customers server was hacked (I presume because we forgot to setup SP4 for SQL Server -- the port was open to the outside world for business purposes!). ... Suddenly, since today, the Exchange Services are not starting anymore. ... Problem 3: Dependencies are disabled! ...
    (microsoft.public.windows.server.sbs)
  • Re: Windows XP pro system backup error
    ... Error messages are a waste of ... I changed the shadow copy checkbox on the ... If not Windows Server 2003 what about Small Business Server? ... Can you please post copies of relevant Error Reports from Event Viewer. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Q321733 hotfix download
    ... Client and server. ... >> You can access Event Viewer by selecting Start, Administrative Tools, and ... View and Manage Event Logs in Event Viewer in Windows XP ...
    (microsoft.public.windowsxp.help_and_support)