SYMPTOMS

• Web mail keeps prompting for Windows authentication, IME passwords being lost and/or SMTP service running slowly and mail backing up
• When accessing web mail in a browser you are prompted for Windows authentication credentials.  The anonymous user (IME_USER) (IME_ADMIN) do not have permission to access the web mail folders. 
• After running MEInstaller.exe (Start->Run->MEInstaller.exe) and executing option number 2 and/or 3 web mail starts to work but after an undetermined amount of time the passwords are lost and again the Windows passwords are required.
• In the Event logs you have an error similar to the following:

The MailEnable SMTP Relay Service service terminated unexpectedly. It has done this XXXXX time(s). The following corrective action will be taken in 3000 milliseconds: Restart the service.

• The SMTP service is running slowly and mail in outbound queues is being processed very slowly.

CAUSE

The service mentioned above from the event log is a virus Trojan that names itself as the "MailEnable SMTP Relay Service" (trying to pose as a MailEnable service). 

If you have Norton (and possibly another AV solutions) it should pick up the virus as rdriv.sys, the virus appears to use a caching kit to conceal it's location.

The service tries to send mail out of the server this has the effect of slowing down mail throughput and utilizes higher than normal CPU making the queues backup on high volume servers.  It also removes some permissions on the MailEnable IME_ADMIN and IME_USER accounts or changes/removes the passwords, the effect of this is the web mail web sites stop working.

SOLUTION

a.exe

bot.exe

bw.exe

gethashes.exe

getsyskey.exe

nc.exe

rdriv.sys

start.bat