SOLVED

Autodiscover infected with virus

%3CLINGO-SUB%20id%3D%22lingo-sub-2232795%22%20slang%3D%22en-US%22%3EAutodiscover%20infected%20with%20virus%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2232795%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20client%20has%20Exchange%20server%202016%20running%20on%20windows%20server%202016%20Standard.%20After%20the%20recent%20zero%20day%20we%20patched%20the%20server%20right%20away%20and%20ran%20the%20mitigation%20tool.%20We%20have%20also%20run%20several%20full%20Microsoft%20safety%20scans%20and%20Windows%20defender%20scans.%20The%20safety%20scans%20and%20mitigation%20tools%20removed%20back%20doors%20and%20we%20have%20been%20running%20them%20regularly%20since.%20A%20few%20days%20later%20one%20of%20the%20users%20mentioned%20that%20they%20keep%20getting%20a%20pop%20up%20about%20a%20virus%20when%20opening%20Outlook.%20The%20message%20is%20attached.%20I%20verified%20that%20the%20same%20thing%20was%20happening%20on%20any%20other%20computer%20using%20Outlook.%20I%20also%20tested%20on%20an%20external%20machine%20that%20was%20a%20clean%20build%20and%20I%20got%20the%20same%20message%20as%20soon%20as%20I%20connected%20Outlook%20to%20their%20exchange%20server.%20I%20tried%20deleting%20and%20recreating%20the%20autodiscover%20virtual%20directory%20but%20the%20issue%20seems%20to%20keep%20going%20after%20that.%20Any%20help%20would%20be%20greatly%20appreciated.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2232795%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2016%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOutlook%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2237449%22%20slang%3D%22en-US%22%3ERe%3A%20Autodiscover%20infected%20with%20virus%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2237449%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1007457%22%20target%3D%22_blank%22%3E%40Tingley5%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHave%20you%20found%20a%20solution%3F%20We%20have%20a%20client%20which%20has%20the%20exact%20same%20issue.%20They%20are%20in%20the%20process%20of%20installing%20a%20new%20Exchange%20server%20to%20migrate%20the%20mailboxes%2C%20but%20not%20sure%20if%20the%20Autodiscover.xml%20error%20will%20disappear%20after%20the%20old%20Exchange%20is%20decommissioned%20and%20the%20clients%20connect%20to%20the%20new%20one.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

My client has Exchange server 2016 running on windows server 2016 Standard. After the recent zero day we patched the server right away and ran the mitigation tool. We have also run several full Microsoft safety scans and Windows defender scans. The safety scans and mitigation tools removed back doors and we have been running them regularly since. A few days later one of the users mentioned that they keep getting a pop up about a virus when opening Outlook. The message is attached. I verified that the same thing was happening on any other computer using Outlook. I also tested on an external machine that was a clean build and I got the same message as soon as I connected Outlook to their exchange server. I tried deleting and recreating the autodiscover virtual directory but the issue seems to keep going after that. Any help would be greatly appreciated. 

 

Thanks

3 Replies

@Tingley5 

 

Have you found a solution? We have a client which has the exact same issue. They are in the process of installing a new Exchange server to migrate the mailboxes, but not sure if the Autodiscover.xml error will disappear after the old Exchange is decommissioned and the clients connect to the new one.

best response confirmed by Tingley5 (New Contributor)
Solution

@Tingley5 

 

Well I found the solution in this case. Apparently the external URL used for the OAB URL was rewritten and changing it back to the original value fixed it.

 

 

@DaveGr1280 

Thanks! That did it!