Flooding Exchange with MSRPC traffic

  • Thread starter Thread starter Michael Lynch
  • Start date Start date
M

Michael Lynch

I have a workstation which is hammering my Exchange server
with RPC traffic. I did a 30 minute trace and the traffic
from this one workstation never stopped. This had happened
before, when I was experiencing slowdowns on the Exchange
server, and I found a couple machines exhibiting this
behavior. I reformatted them all after antivirus sweeps
declared them clean. The present machine responsible for
the RPC flood to the Exchange server ( I haven't checked
other servers for RPC traffic from this workstation) is
one of the ones I reformatted!! So I guess this isn't
virus or screwed up Windows. Should I assume this is a
malfunctioning NIC? What other possibilities are there
that would explain this behavior?
Thanks.
 
You might also want to make sure it's not the Blaster worm
or a variant, there have been a lot of RPC exploits these
last few months. Make sure the machine that is causing
the RPC traffic has all the current security patches.
Visit windowsupdate.microsoft.com to help with this.
 
Back
Top