Exchange event in SBS

Here is the text from several days of SBS reports---- Looks like a
trojan/spam/virus is trying to phone home. The only protection the SBS server
has is the Firewall. No communications or traffic other than internal lan
traffic occurs on this server. It is the gateway for internet traffic and
Exchange has the spam filter turned on.


Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public Store
2028 7/10/2008 3:10 AM 16 *
The delivery of a message sent by public folder GRAPHICS
ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
everett@aimware.com Cc: The non-delivery report has been deleted. For more
information, click http://www.microsoft.com/contentredirect.asp.

Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public Store
2028 7/9/2008 3:12 AM 15 *
The delivery of a message sent by public folder GRAPHICS
ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
EOLICA_ING_ZAMUDIO_GAMESA Cc: The non-delivery report has been deleted. For
more information, click http://www.microsoft.com/contentredirect.asp.

Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public Store
2028 7/8/2008 3:35 AM 16 *
The delivery of a message sent by public folder GRAPHICS
ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
qrtcmwkdqmb@2inch.nl Cc: The non-delivery report has been deleted. For more
information, click http://www.microsoft.com/contentredirect.asp.

Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public Store
2028 7/7/2008 3:43 AM 22 *
The delivery of a message sent by public folder GRAPHICS
ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
6345497@genesyslab.com Cc: The non-delivery report has been deleted. For more
information, click http://www.microsoft.com/contentredirect.asp.

Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public Store
2028 7/6/2008 11:09 PM 58 *
The delivery of a message sent by public folder GRAPHICS
ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
root@arkvalleyccb.org Cc: The non-delivery report has been deleted. For more
information, click http://www.microsoft.com/contentredirect.asp.

Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public Store
2028 7/5/2008 3:44 AM 33 *
The delivery of a message sent by public folder GRAPHICS
ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To: stvia@mrak.net
Cc: The non-delivery report has been deleted. For more information, click
http://www.microsoft.com/contentredirect.asp.


Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public Store
2028 7/1/2008 3:08 PM 1
The delivery of a message sent by public folder GRAPHICS
ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
graphicscd@jwtel.com Cc: The non-delivery report has been deleted. For more
information, click http://www.microsoft.com/contentredirect.asp.

Any ideas on how to proceed appreciated.....

Russ
Thu Jul 10 10:08:31 PDT 2008

OH you are the famous Bitbob

Try this bob

NDRs are deleted by the Microsoft Exchange Information Store service when a
public folder is designated as the recipient in Exchange Server 2003
http://support.microsoft.com/kb/900088

Russ

--
Russell Grover - SBITS.Biz
Microsoft Gold Certified Partner
Microsoft Small Business Specialist
World Wide Remote SBS2003 Support - http://www.SBITS.Biz
Get Help Now! http://www.crossloop.com/SBITSdotBiz


"Bitbob" <Bitbob@discussions.microsoft.com> wrote in message
news:6003B5EB-CC4B-49FB-ABC3-7CA69AC1BE5C@microsoft.com...
> Here is the text from several days of SBS reports---- Looks like a
> trojan/spam/virus is trying to phone home. The only protection the SBS
> server
> has is the Firewall. No communications or traffic other than internal lan
> traffic occurs on this server. It is the gateway for internet traffic and
> Exchange has the spam filter turned on.
>
>
> Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> Store
> 2028 7/10/2008 3:10 AM 16 *
> The delivery of a message sent by public folder GRAPHICS
> ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> everett@aimware.com Cc: The non-delivery report has been deleted. For more
> information, click http://www.microsoft.com/contentredirect.asp.
>
> Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> Store
> 2028 7/9/2008 3:12 AM 15 *
> The delivery of a message sent by public folder GRAPHICS
> ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> EOLICA_ING_ZAMUDIO_GAMESA Cc: The non-delivery report has been deleted.
> For
> more information, click http://www.microsoft.com/contentredirect.asp.
>
> Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> Store
> 2028 7/8/2008 3:35 AM 16 *
> The delivery of a message sent by public folder GRAPHICS
> ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> qrtcmwkdqmb@2inch.nl Cc: The non-delivery report has been deleted. For
> more
> information, click http://www.microsoft.com/contentredirect.asp.
>
> Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> Store
> 2028 7/7/2008 3:43 AM 22 *
> The delivery of a message sent by public folder GRAPHICS
> ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> 6345497@genesyslab.com Cc: The non-delivery report has been deleted. For
> more
> information, click http://www.microsoft.com/contentredirect.asp.
>
> Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> Store
> 2028 7/6/2008 11:09 PM 58 *
> The delivery of a message sent by public folder GRAPHICS
> ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> root@arkvalleyccb.org Cc: The non-delivery report has been deleted. For
> more
> information, click http://www.microsoft.com/contentredirect.asp.
>
> Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> Store
> 2028 7/5/2008 3:44 AM 33 *
> The delivery of a message sent by public folder GRAPHICS
> ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> stvia@mrak.net
> Cc: The non-delivery report has been deleted. For more information, click
> http://www.microsoft.com/contentredirect.asp.
>
>
> Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> Store
> 2028 7/1/2008 3:08 PM 1
> The delivery of a message sent by public folder GRAPHICS
> ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> graphicscd@jwtel.com Cc: The non-delivery report has been deleted. For
> more
> information, click http://www.microsoft.com/contentredirect.asp.
>
> Any ideas on how to proceed appreciated.....

Bitbob
Thu Jul 10 13:43:01 PDT 2008


Russ: I am more concerned with the program which is trying to mail out
E-mail than the fact that exchange is deleting the NDR or am I reading the
error message backwards and it is indicating that the variable addresses are
the sending addresses. --------?
"Russ (www.SBITS.Biz)" wrote:

> OH you are the famous Bitbob
>
> Try this bob
>
> NDRs are deleted by the Microsoft Exchange Information Store service when a
> public folder is designated as the recipient in Exchange Server 2003
> http://support.microsoft.com/kb/900088
>
> Russ
>
> --
> Russell Grover - SBITS.Biz
> Microsoft Gold Certified Partner
> Microsoft Small Business Specialist
> World Wide Remote SBS2003 Support - http://www.SBITS.Biz
> Get Help Now! http://www.crossloop.com/SBITSdotBiz
>
>
> "Bitbob" <Bitbob@discussions.microsoft.com> wrote in message
> news:6003B5EB-CC4B-49FB-ABC3-7CA69AC1BE5C@microsoft.com...
> > Here is the text from several days of SBS reports---- Looks like a
> > trojan/spam/virus is trying to phone home. The only protection the SBS
> > server
> > has is the Firewall. No communications or traffic other than internal lan
> > traffic occurs on this server. It is the gateway for internet traffic and
> > Exchange has the spam filter turned on.
> >
> >
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/10/2008 3:10 AM 16 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > everett@aimware.com Cc: The non-delivery report has been deleted. For more
> > information, click http://www.microsoft.com/contentredirect.asp.
> >
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/9/2008 3:12 AM 15 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > EOLICA_ING_ZAMUDIO_GAMESA Cc: The non-delivery report has been deleted.
> > For
> > more information, click http://www.microsoft.com/contentredirect.asp.
> >
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/8/2008 3:35 AM 16 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > qrtcmwkdqmb@2inch.nl Cc: The non-delivery report has been deleted. For
> > more
> > information, click http://www.microsoft.com/contentredirect.asp.
> >
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/7/2008 3:43 AM 22 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > 6345497@genesyslab.com Cc: The non-delivery report has been deleted. For
> > more
> > information, click http://www.microsoft.com/contentredirect.asp.
> >
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/6/2008 11:09 PM 58 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > root@arkvalleyccb.org Cc: The non-delivery report has been deleted. For
> > more
> > information, click http://www.microsoft.com/contentredirect.asp.
> >
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/5/2008 3:44 AM 33 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > stvia@mrak.net
> > Cc: The non-delivery report has been deleted. For more information, click
> > http://www.microsoft.com/contentredirect.asp.
> >
> >
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/1/2008 3:08 PM 1
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > graphicscd@jwtel.com Cc: The non-delivery report has been deleted. For
> > more
> > information, click http://www.microsoft.com/contentredirect.asp.
> >
> > Any ideas on how to proceed appreciated.....
>
>
>

barretech
Tue Jul 15 10:57:48 PDT 2008

Russ, he probably has NO clue about why you are saying he is
famous :^) Luckily I decided to check the NG's again and boy am I
thankful I did.

Bitbob, I hate to bug you since you seem very busy. Plus I hate to
cross-post. But you are my hope. Back in 2005 you had a problem with
Outlook Over RPC, with no resolution. Seems like only one username on
one computer had a problem, all others worked fine with Outlook over
RPC. I am in the same predicament and beg you to throw me a bone and
think about how you fixed the problem. Assuming you fixed it at all.

I am getting ready (started today) to create a new account and use
Exmerge to move all the users' data from one mailbox to a new one,
move the email address, all his settings, etc. I'd love to know how to
make Outlook over RPC work past this problem....

Can you help? I could even P*yPal you for half an hour if it would
help. TIA for any consideration. You could email me at
barretech@hotmail.com if you wish. Thanks again.

Barre




On Jul 10, 1:08=A0pm, "Russ \(www.SBITS.Biz\)"
<supp...@REMOVETHIS.sbits.biz> wrote:
> OH you are the famousBitbob
>
> Try this bob
>
> NDRs are deleted by the Microsoft Exchange Information Store service when=
a
> public folder is designated as the recipient in Exchange Server 2003http:=
//support.microsoft.com/kb/900088
>
> Russ
>
> --
> Russell Grover - SBITS.Biz
> Microsoft Gold Certified Partner
> Microsoft Small Business Specialist
> World Wide Remote SBS2003 Support -http://www.SBITS.Biz
> Get Help Now!http://www.crossloop.com/SBITSdotBiz
>
> "Bitbob" <Bit...@discussions.microsoft.com> wrote in message
>
> news:6003B5EB-CC4B-49FB-ABC3-7CA69AC1BE5C@microsoft.com...
>
>
>
> > Here is the text from several days of SBS reports---- Looks like a
> > trojan/spam/virus is trying to phone home. The only protection the SBS
> > server
> > has is the Firewall. No communications or traffic other than internal l=
an
> > traffic occurs on this server. It is the gateway for internet traffic a=
nd
> > Exchange has the spam filter turned on.
>
> > Source Event ID Last Occurrence Total Occurrences =A0MSExchangeIS Publi=
c
> > Store
> > 2028 7/10/2008 3:10 AM 16 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > ever...@aimware.com Cc: The non-delivery report has been deleted. For m=
ore
> > information, clickhttp://www.microsoft.com/contentredirect.asp.
>
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/9/2008 3:12 AM 15 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > EOLICA_ING_ZAMUDIO_GAMESA Cc: The non-delivery report has been deleted.
> > For
> > more information, clickhttp://www.microsoft.com/contentredirect.asp.
>
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/8/2008 3:35 AM 16 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > qrtcmwkd...@2inch.nl Cc: The non-delivery report has been deleted. For
> > more
> > information, clickhttp://www.microsoft.com/contentredirect.asp.
>
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/7/2008 3:43 AM 22 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > 6345...@genesyslab.com Cc: The non-delivery report has been deleted. Fo=
r
> > more
> > information, clickhttp://www.microsoft.com/contentredirect.asp.
>
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/6/2008 11:09 PM 58 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > r...@arkvalleyccb.org Cc: The non-delivery report has been deleted. For
> > more
> > information, clickhttp://www.microsoft.com/contentredirect.asp.
>
> > Source Event ID Last Occurrence Total Occurrences =A0MSExchangeIS Publi=
c
> > Store
> > 2028 7/5/2008 3:44 AM 33 *
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > st...@mrak.net
> > Cc: The non-delivery report has been deleted. For more information, cli=
ck
> >http://www.microsoft.com/contentredirect.asp.
>
> > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > Store
> > 2028 7/1/2008 3:08 PM 1
> > The delivery of a message sent by public folder GRAPHICS
> > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > graphic...@jwtel.com Cc: The non-delivery report has been deleted. For
> > more
> > information, clickhttp://www.microsoft.com/contentredirect.asp.
>
> > Any ideas on how to proceed appreciated.....- Hide quoted text -
>
> - Show quoted text -

Bitbob
Mon Aug 11 14:24:01 PDT 2008

Barre: Finally let it go and fell back to RWW outlook--Could not get
consistent connection with many different types of clients.. Sorry

"barretech@hotmail.com" wrote:

> Russ, he probably has NO clue about why you are saying he is
> famous :^) Luckily I decided to check the NG's again and boy am I
> thankful I did.
>
> Bitbob, I hate to bug you since you seem very busy. Plus I hate to
> cross-post. But you are my hope. Back in 2005 you had a problem with
> Outlook Over RPC, with no resolution. Seems like only one username on
> one computer had a problem, all others worked fine with Outlook over
> RPC. I am in the same predicament and beg you to throw me a bone and
> think about how you fixed the problem. Assuming you fixed it at all.
>
> I am getting ready (started today) to create a new account and use
> Exmerge to move all the users' data from one mailbox to a new one,
> move the email address, all his settings, etc. I'd love to know how to
> make Outlook over RPC work past this problem....
>
> Can you help? I could even P*yPal you for half an hour if it would
> help. TIA for any consideration. You could email me at
> barretech@hotmail.com if you wish. Thanks again.
>
> Barre
>
>
>
>
> On Jul 10, 1:08 pm, "Russ \(www.SBITS.Biz\)"
> <supp...@REMOVETHIS.sbits.biz> wrote:
> > OH you are the famousBitbob
> >
> > Try this bob
> >
> > NDRs are deleted by the Microsoft Exchange Information Store service when a
> > public folder is designated as the recipient in Exchange Server 2003http://support.microsoft.com/kb/900088
> >
> > Russ
> >
> > --
> > Russell Grover - SBITS.Biz
> > Microsoft Gold Certified Partner
> > Microsoft Small Business Specialist
> > World Wide Remote SBS2003 Support -http://www.SBITS.Biz
> > Get Help Now!http://www.crossloop.com/SBITSdotBiz
> >
> > "Bitbob" <Bit...@discussions.microsoft.com> wrote in message
> >
> > news:6003B5EB-CC4B-49FB-ABC3-7CA69AC1BE5C@microsoft.com...
> >
> >
> >
> > > Here is the text from several days of SBS reports---- Looks like a
> > > trojan/spam/virus is trying to phone home. The only protection the SBS
> > > server
> > > has is the Firewall. No communications or traffic other than internal lan
> > > traffic occurs on this server. It is the gateway for internet traffic and
> > > Exchange has the spam filter turned on.
> >
> > > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > > Store
> > > 2028 7/10/2008 3:10 AM 16 *
> > > The delivery of a message sent by public folder GRAPHICS
> > > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > > ever...@aimware.com Cc: The non-delivery report has been deleted. For more
> > > information, clickhttp://www.microsoft.com/contentredirect.asp.
> >
> > > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > > Store
> > > 2028 7/9/2008 3:12 AM 15 *
> > > The delivery of a message sent by public folder GRAPHICS
> > > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > > EOLICA_ING_ZAMUDIO_GAMESA Cc: The non-delivery report has been deleted.
> > > For
> > > more information, clickhttp://www.microsoft.com/contentredirect.asp.
> >
> > > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > > Store
> > > 2028 7/8/2008 3:35 AM 16 *
> > > The delivery of a message sent by public folder GRAPHICS
> > > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > > qrtcmwkd...@2inch.nl Cc: The non-delivery report has been deleted. For
> > > more
> > > information, clickhttp://www.microsoft.com/contentredirect.asp.
> >
> > > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > > Store
> > > 2028 7/7/2008 3:43 AM 22 *
> > > The delivery of a message sent by public folder GRAPHICS
> > > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > > 6345...@genesyslab.com Cc: The non-delivery report has been deleted. For
> > > more
> > > information, clickhttp://www.microsoft.com/contentredirect.asp.
> >
> > > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > > Store
> > > 2028 7/6/2008 11:09 PM 58 *
> > > The delivery of a message sent by public folder GRAPHICS
> > > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > > r...@arkvalleyccb.org Cc: The non-delivery report has been deleted. For
> > > more
> > > information, clickhttp://www.microsoft.com/contentredirect.asp.
> >
> > > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > > Store
> > > 2028 7/5/2008 3:44 AM 33 *
> > > The delivery of a message sent by public folder GRAPHICS
> > > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > > st...@mrak.net
> > > Cc: The non-delivery report has been deleted. For more information, click
> > >http://www.microsoft.com/contentredirect.asp.
> >
> > > Source Event ID Last Occurrence Total Occurrences MSExchangeIS Public
> > > Store
> > > 2028 7/1/2008 3:08 PM 1
> > > The delivery of a message sent by public folder GRAPHICS
> > > ARCHIVEEA376AEA42967AFA95F789B580145310004313 has failed. To:
> > > graphic...@jwtel.com Cc: The non-delivery report has been deleted. For
> > > more
> > > information, clickhttp://www.microsoft.com/contentredirect.asp.
> >
> > > Any ideas on how to proceed appreciated.....- Hide quoted text -
> >
> > - Show quoted text -
>
>