Re: Inetinfo.exe dragging server and email down

Tech-Archive recommends: Fix windows errors by optimizing your registry

OK,

This is what I have done.

Stopped the SMTP connector service.

Went and renamed the BadMail & Queue directories, created new ones, deleted
the old ones.

Deleted the SMTP connector, then created a new SmallBusiness SMTP connector
and started it.

Checked the queues and now all is fine.

Worring thing is I kept deleting 100,000 mails in the queue and they kept
coming and not sure from where?

Anyway all seems to be working again!

Thanks to all who replied.

Cheers Andrew

"Jim Behning SBS MVP" wrote:

Yes. You missed the part of the article where it has you sending all
mail to a dud email address like 99.99.99.99

Clean up the Exchange Server's SMTP queues

Warning During this process, ALL messages that are destined for
external SMTP recipients are deleted. Internal e-mail and incoming
e-mail from the Internet are not affected. The settings below are
temporary and steps to undo these changes will be included later in
this section.

Note A webcast is available that demonstrates how to clean up the
Exchange Server's SMTP queues. To view this webcast, click the
following link:
http://support.microsoft.com/servicedesks/ShowMeHow/101904_3.asx
(http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fservicedesks%2fshowmehow%2f101904_3.asx)
1. In Exchange System Manager, click SmallBusiness SMTP Connector
under Connectors. This phase requires an SMTP connector. If the
Exchange server does not have an SMTP connector, create one. To do
this, follow these steps: a. Right-click Connectors, click New, and
then click SMTP Connector.
b. On the General tab, type a temporary name (Temp Connector, for
example) in the Name box.
c. Click Add at the bottom, select the server name and its associated
SMTP Virtual Server, and then click OK.
d. Click Address Space.
e. Click Add, click SMTP, and then click OK.
f. In the Internet Address Space Properties dialog box, leave the
default settings (E-mail domain * and Cost 1), and then click OK.
g. Click the General tab, and then go to step 4.

2. Right-click SmallBusiness SMTP Connector, and then click
Properties. If you have more than one SMTP Connector, the one that you
want to work with in the following steps is the one that contains the
"*" (asterisk) for the SMTP address on the Address Space tab.


3. Click the General tab. Make a note of all the settings on this tab.
You have to return these settings later in this article.
4. Click Forward all mail through this connector to the following
smart hosts.
5. In the field provided, type a false IP address and enclose it in
brackets. For example, type [99.99.99.99].
6. Click the Deliver Options tab .
7. Click Specify when messages are sent through this connector.
8. In the Connection Time list, click Run daily at 11:00 PM.
9. Click OK to close the SMTP Connector Properties dialog box.
10. Expand Servers, expand Servername, expand Protocols, expand SMTP.
Right-click the Default SMTP Virtual Server, and then click Stop.
11. It may take several minutes for the SMTP Virtual Server to stop.
After the Default SMTP Virtual Server has stopped, right-click the
Default SMTP Virtual Server again, and then click Start. It may take
several minutes for the Default SMTP Virtual Server to start.
12. After the Default SMTP Virtual Server has started, wait about 10
minutes.

Now the Default SMTP Virtual Server can re-enumerate the messages and
put them in a single queue for the SmallBusiness SMTP Connector or for
the one that you named when you created it in step 1.b.
13. After about 10 minutes, expand Default SMTP Virtual Server, and
then click Queues.
14. Note the total number of messages on the right next to the Small
Business SMTP Connector.

This number has to stabilize so that all the messages can be deleted
at the same time.
15. Right-click Queues, and then click Refresh approximately every 15
minutes.
16. Repeat step 15 until the total number of messages remains
constant.
17. Locate the queue for the SmallBusiness SMTP Connector. The queue
is indicated by the small red clock on the yellow folder icon.
18. Depending on your version of Small Business Server installation,
follow the appropriate section to delete the messages from the queues:
• Small Business Server 2003: Right-click SmallBusiness SMTP
Connector, and then click Find Messages. In the corresponding box,
click the dropdown and select an appropriate number in Number of
messages to be listed in the search. Click Find Now. In the results,
select all the messages (SHIFT+PAGE DOWN). Right-click the selected
messages, and then click Delete All Messages (No NDR).
• Small Business Server 2000: Right-click SmallBusiness SMTP
Connector, and then click Delete All Messages (No NDR).

19. Click Yes when you are prompted with the question of whether to
delete messages in the selected queue. Deleting these message may take
some time, depending on the number of messages in the queue.
20. After the messages are deleted, right-click Queues, and then click
Refresh.
21. Note the total number of messages for the SmallBusiness SMTP
Connector queue. The number is zero.
22. Wait approximately 5 minutes, and then refresh Queues again. The
goal is to have the number of messages in the SmallBusiness SMTP
Connector queue reach zero and stay at zero. If this number increases,
the Exchange server is still processing messages for external delivery
through the SmallBusiness SMTP Connector. Repeat this step until the
number stabilizes again.
23. Repeat steps 19 through 23 until the number of messages in the
SmallBusiness SMTP Connector queue is consistently zero. When it is,
the Exchange server's SMTP queues have been purged of the unsolicited
commercial e-mail.


After Exchange has been cleaned of the unsolicited commercial e-mail,
you have to undo the changes that you made in steps 2 through 8. To
undo the changes, follow these steps: 1. In Exchange System Manager,
expand Connectors, right-click the SmallBusiness SMTP Connector, and
then click Properties.

If you created a temporary SMTP connector in step 1, click Delete
instead of Properties, and then go to step 7.
2. On the General tab, change these settings to those documented in
step 3 under Clean Up the Exchange Server's SMTP Queues.
3. Click the Delivery Options tab.
4. Verify that Specify when messages are sent through this connector
is selected.
5. In the Connection Time list, click Always Run.
6. Click OK.
7. Expand Servers, expand Servername, expand Protocols, and then
expand SMTP. Right-click Default SMTP Virtual Server, and then click
Stop.
8. After the SMTP Virtual Server has stopped, right-click Default SMTP
Virtual Server again, and then click Start.
Now you have configured the Exchange server to block open SMTP
relaying and you have removed the unsolicited commercial e-mail from
Exchange Server's SMTP queues. The next step is to clean up the file
system.



On Mon, 7 Jul 2008 16:44:01 -0700, SSUKCORP
<SSUKCORP@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

Hi,

Closed the relay and now working from the KB article that you suggested. But
have been deleting 10,000 messages every few minutes from the queue but they
still keep coming back?

Have I missed somethiing?

Cheers

Andrew

"Jim Behning" wrote:

Try this first.
http://blogs.technet.com/sbs/archive/2008/06/04/allow-authenticated-relay.aspx

What antivirus malware are you doing on your server and workstations?

Here are things I do to keep my servers reasonably safe.
http://msmvps.com/blogs/bgb/archive/2008/02/23/exchange-connection-filter-using-a-real-time-block-list-and-imfperfmon-msc.aspx

And here is an article to clean up all the crud stuck in the queues. Note
you may lose some good stuff so ask your users to make sure they resend good
stuff after you have tightened up your server.
http://support.microsoft.com/kb/324958




"SSUKCORP" wrote:

I have inetinfo.exe at 2 GB memory usage and increasing! Outgoing and
Incoming mail has stopped and I looked in the Queues under Exchange System
Manager and found 20,000 plus mails waiting to go out. We only send between 5
- 10 email a day.

What has happened as it is gragging everything down.

SBS2002 SP2

Help, cheers Andrew
See what SBS support is working on
http://blogs.technet.com/sbs/default.aspx
Check your SBS with the SBS Best Practices Analyzer
http://blogs.technet.com/sbs/archive/tags/BPA/default.aspx

.

Relevant Pages

  • Re: Inetinfo.exe dragging server and email down
    ... Stopped the SMTP connector service. ... Deleted the SMTP connector, then created a new SmallBusiness SMTP connector ... Checked the queues and now all is fine. ... Right-click the Default SMTP Virtual Server, ...
    (microsoft.public.windows.server.sbs)
  • Re: Inetinfo.exe dragging server and email down
    ... Clean up the Exchange Server's SMTP queues ... click SmallBusiness SMTP Connector ... Right-click the Default SMTP Virtual Server, ...
    (microsoft.public.windows.server.sbs)
  • Re: Inetinfo.exe dragging server and email down
    ... Clean up the Exchange Server's SMTP queues ... click SmallBusiness SMTP Connector ... Right-click the Default SMTP Virtual Server, ...
    (microsoft.public.windows.server.sbs)
  • Re: Strange problem with Exchange/ Reverse NDR attack
    ... Last week my SBS box notified me that I had several messages waiting in the queues, so after some investigation, I found out that It was under a reverse NDR attack, and or being used to relay unsolicited email. ... Well, the queues stopped in the SMTP connector with the NDR's, and all seemed great. ... When an email is sent from inside our Domain to outside of our Domain, the domain to which the email is being sent to shows up in the SMTP queue for a few moments, then goes away if all is well. ... Often, the whole original email is quoted, thus sending spam to your user from a legitimate mail server, from where it is unlikely to be refused. ...
    (microsoft.public.windows.server.sbs)
  • RE: Exchange not sending emails - waiting in SCHEDULED state
    ... SMTP connector which had been set for sending every hour. ... Regarding how I synchronized Exchange: ... Open the properties page of the Default SMTP Virtual Server in Exchange ...
    (microsoft.public.windows.server.sbs)