The exchange mail server has several services running to enable it do its job. There are many ways to deploy an email server solution, whether single stand-alone, cluster, frontend, backend, etc

One crucial service is the SMTP that enables you to send and receive emails to other email servers

If this is stopped then you won’t be able to send or receive emails to the outside world, and if your email clients are configured as exchange mails server clients, then they’ll be able to send within the server but not outside

In our world of massive kind of attacks, there is one kind which is worm email mass attack, where a workstation is processing emails in a mass amount, this can be monitored and blocked

So having this control rule on an email server can have devastating effects because although the email server sending and receiving of large amount of emails is legitimate, the behaviour of this is considered abnormal and thus blocked and you’ll see that the SMTP service will stop and fail to start

Check the anti-virus application you have and see if you have any control rules and if you are able to momentarily disable it, the SMTP won’t start right away, it’ll take time and bear in mind if you are using an Anti-virus management application for your network, then also keep in mind that what you define manually on the client station will be over-written by the policies pushed from that management application over a specified time periods. So once this rule is disable the SMTP will start and after polling policies from the management application it’ll stop again, never ending cycle, so this has to managed by creating separate policies

Having a rule blocking port 25 for mass emails doesn’t necessarily mean that all clients who are under this policy won’t be able to send emails. We do have applications where you configure your mail server, port, account to send for example daily reports. It is sending a number of reports per day, so this isn’t considered a peculiar behaviour but if that workstation is infected with some kind of emailing worm and starts shooting away large amount of emails then this behaviour will be stopped

One more, trust your instincts. If something was working and then not working, then 90% the latest updates/additions you made is causing the problem. If I can I would go HUG my supervisor ;D -sorry about disturbing you on your time off-

When getting infected with a virus the first thing is to restart in safe mode, because windows loads the minimal files to run. You can delete the virus files manually or you don’t have to do safe mode … depends of the situation

Disable windows’ restore point because it takes backup of everything including infected files and the virus engine cannot remove those

Most probably you have an idea of what you are dealing with, so check for unfamiliar processes running on your PC and kill them. Sometimes the virus disables functions, like task manager you can go about that with the registry editor (run -> regedit), just don’t play with those unless you read how to do it

Scan the whole PC and make sure the virus definition update is the latest

Check the process that run at startup (run -> msconfig), clear selected suspicious processes

Most virus files are hidden and inject themselves in root drives, system folders, temp folders, etc. In a windows explorer tools -> folder options -> view -> under hidden files and folders select show hidden files and folders. If this is disabled too or you have problems, again registry keys needs to be modified. How to do this in Vista, I have no idea ;p -still in denial that I’m using it!!-

Search the registry keys for the virus and delete the entries

Google the virus and you are bound to find a solution, what I listed is the common practices for cleaning viruses. of course, some are harder to clean than others. Also, the behaviour differs. Some do minimal harm, others well, you can kiss your PC goodbye!!