Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Have a Windows SBS Server I've encountered which I have suspicions it's been compromised in some way.

Symptoms:

11.8gb of 12gb total RAM at all times, even after restricting the Exchange store to 4gb.

Multiple instances of w3wp.exe which I understand are IIS databases running. 9 in total using over 1gb of RAM.

Multiple login failures appearing in Event log.

Windows Update turned off, not through obvious GPEdit policies. 45 outstanding Windows Critical updates.

Disabled firewalls (inbuilt and Kaspersky). Hardware firewall (on router) is running and configured for incoming RDP, FTP, SMTP directed to Server.

Ongoing slowness of the network regardless of any 'upgrades' (gigabit cards fitted to all Workstations).

What should be my next steps? How can I track where and what IIS databases have been setup/run. How about SQL server, would you expect that to be running with Exchange and FTP? Any tools I can run to check what has been opened on the server?

share|improve this question
    
My next step (in the morning) with the Hardware and OS support company is to close it up, install all the security updates etc. Is Malwarebytes capable of closing IIS databases etc on SBS2011? –  HaydnWVN Apr 19 '12 at 17:47
add comment

1 Answer

up vote 1 down vote accepted

I'm not quite sure if anything is actually wrong. Our own SBS is currently sitting at 11.6GB. enter image description here

The SBS contains a lot of services that eat a lot of RAM. For an Exchange server alone, I would usually commission 12GB alone.

You might want to check if you're running SharePoint and shut that down if you don't need it. Usually, I'd get another 12GB for that.

So, I'm not surprised. If this isn't normal, then I'd have a problem as well ;)

share|improve this answer
    
Are you running IIS? 8 different instances of w3wp.exe which from what i've read so far are different databases, your usage seems similar to what we have. I'm confident we're not running Sharepoint. Exchange is restricted, yet only has to service 3 mailboxes, 2 of them very light usage. I'm pondering restricting the store further... –  HaydnWVN Apr 20 '12 at 8:33
    
After getting two seperate support engineers to investigate they're 100% sure it's not been exploited and it's just attempts as the firewalls not locked down enough... Will be configuring it and tightening things to shore it up. Thanks for reassuring me! –  HaydnWVN Apr 23 '12 at 13:04
    
Sorry, I forgot replying to your first comment. Yes, we run IIS, we need it to supply OWA and SharePoint. Please keep in mind that the minimal memory amount for SBS2011 is already 8GB. So this isn't even too far off that value. –  Oliver Salzburg Apr 23 '12 at 13:17
    
Agreed, 12GB isn't much for SBS2011, but when it's only serving 3 PC's/users (2 of which are very light usage) i'm rather annoyed it's so sluggish... Then also not surprised when running some large database software alongside Exchange. –  HaydnWVN Apr 25 '12 at 9:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.