Last month I came to discover that my mail relay options had been changed from No Relay to Relay for Anyone and overnight (36 hrs about) we passed thousands of Spam messages. Our queue mgr was "stuck". I could not stop it from the Imail console, task manager, or services window. I ended up uninstalling it through DOS.
For reasons I won't elaborate here, I do not feel as though we have accurately traced the cause of this phenomenon and would like to rebuild our Imail server. Since that day, it has been "acting weird" and I don't trust it's security/integrity anymore. I made a baseline backup copy of my Windows 2000 Server after I did the initial install, service packed it and configured it to NSA specifications but before placing any programs on top of it. Although restoring from this backup won't actually reformat the drives, I feel as though that would be a fine place to revert to. NOTE: I don't have anyone actively using this server yet, so I don't have to worry about mail services interruptions. No one has mail in their boxes that is important, just test stuff. My Plan: Export mailboxes (with registry settings?) Export phraselist, kill list, antispam table, exclude list, white list Restore from backup to Window 2000. Service Pack 4. Reinstall Imail from CD. Reconfigure Imail from scratch (importing the above lists). Reinstall Imail Antivirus (shame on me for buying it, but I might as well use it!). Import mailboxes (with registry settings?) Questions: 1. How "safe" it to export/import mailbox registry settings considering my server may have been compromised from the outside and the Imail program was directly affected (among other things)? 2. I have upgraded from 7.11 to 8.1 since the original install. Should I repeat the 7.11 install to 8.0 to 8.1 path if I export/import registry settings to maintain integrity or can I skip to 8.0 (patched) and still use the imported registry? 3. I checked the utilities page on the web but struck out. Does anyone know of/or would share, a utility that would document my Imail settings? It'd be easier to rebuild from exported documentation! I do have backups from just before the problem started so if I forget to export something, I could always dig it up from those tapes. I don't want to rely on those backups since I can't document when the initial hack took place - it could have been right as the program changes were made, or a backdoor could have been opened well before. Still, I have some sort of a safety net. If it matters...we have one domain, POP3 boxes, approx. 150 accounts. BTW: The Windows ME disks went out yesterday. I lost that battle, but won the right to administer my Imail server the way I see fit...to rebuild it! This IS winning...right? :o( As always...I'm thankful for all of your help, ~Amy To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
