STORE.EXE constantly running

Hello,

STORE.EXE is constantly running on my server and sucking
up all my HD space with something??? I don't see any
email messages coming in or out. I did notice 2 days ago
that I received about 4500+ NDR's from email trying to go
out but I don't know where they came from. This raised a
flag as to the possibility of my server being used as a
spam relay but that has not panned out, at least not that
I can see. I have run 2 different virus scans with 2
different scanners and come up empty. Does anyone have
any suggestions as to what could be causing this and what
I can do about it. Thanks for any and all info.

Chris

Steve
Tue Dec 09 20:48:04 CST 2003

Chris wrote:

> Hello,
>
> STORE.EXE is constantly running on my server and sucking
> up all my HD space with something??? I don't see any
> email messages coming in or out. I did notice 2 days ago
> that I received about 4500+ NDR's from email trying to go
> out but I don't know where they came from. This raised a
> flag as to the possibility of my server being used as a
> spam relay but that has not panned out, at least not that
> I can see. I have run 2 different virus scans with 2
> different scanners and come up empty. Does anyone have
> any suggestions as to what could be causing this and what
> I can do about it. Thanks for any and all info.
>
> Chris

Store.exe *should* be continuously running, otherwise your mail would
not work.

If it is using up disk space, check the C:\Program
Files\ExchSrvr\MDBData folder for lots of E0#####.LOG files all of 5Mb
size. I'd guess these are probably bulding up, and if this is the case,
it's because you're not doing an Exchange-aware backup every night,
either using the native Backup application or a 3rd-party alternative
such as BackupExec for SBS.

A virus scan will not tell you whether your server is acting as an open
relay. To test that, visit http://abuse.net/relay or www.ordb.org. Note
that if you use ordb and the test fails, they will put you on their
blacklist - they will take you straight back off once you can
demonstrate that you're no longer an open relay.

--
Steve Foster [SBS MVP]
---------------------------------------
MVPs do not work for Microsoft. Please reply only to the newsgroups.

Henry
Tue Dec 09 20:53:03 CST 2003

> 4500+ NDR's from email trying to go out
>but I don't know where they came from.

3x9's you're an Open Relay. A/V scan or not.
( AV won't pick up if the SPAMERs are authenticated to your domain having
cracked a user password or using the Guest account. )

Prevent Unsolicited Commercial E-Mail in Exchange 2000 Server
http://support.microsoft.com/?kbid=319356

Also ensure the Guest Account is disabled.
Restrict remote log-on to only those for whom it is absolutely necessary
Rename the Administrator account
Ensure Password policies are set to use complex passwords
Reset all passwords.
Use password expiry periods.
Reset passwords after an employee leaves.

Check for rogue apps/services.

Spybot Search and destroy:
http://www.safer-networking.org/
HijackThis:
http://www.spywareinfo.com/~merijn/index.html

--
Henry Craven.

========= Post It Appropriately: ============
SBS 4/4.5 : microsoft.public.backoffice.smallbiz
SBS 2000 : microsoft.public.backoffice.smallbiz2000
SBS 2003 : microsoft.public.windows.server.sbs
=====================================

"Chris" <chris@carea.ab.ca> wrote in message
news:107f01c3be7d$429275f0$a501280a@phx.gbl...
> Hello,
>
> STORE.EXE is constantly running on my server and sucking
> up all my HD space with something??? I don't see any
> email messages coming in or out. I did notice 2 days ago
> that I received about 4500+ NDR's from email trying to go
> out but I don't know where they came from. This raised a
> flag as to the possibility of my server being used as a
> spam relay but that has not panned out, at least not that
> I can see. I have run 2 different virus scans with 2
> different scanners and come up empty. Does anyone have
> any suggestions as to what could be causing this and what
> I can do about it. Thanks for any and all info.
>
> Chris