Exchange Server 2013 Compromised Suspicious IIS Modules

Question

Hey Everyone, hope you're well.

Can someone please confirm for my sanity.

After Hafnium Shell exploit and a run of EOMT scripts and IISRewrites I still have what I expect to be suspicious native modules in IIS.
A belated update to CU23 did show that the applicationhost.config while was written to, I've not copied all of the globalmodules, but doea anyone know if this UpData
module is part of the usual IIS modules, looks suspicious to me and until I get rid of it I can't access OWA/EMS/ECP and have errors in event logs.

... <add name="kerbauth" image="c:\Program Files\Microsoft\Exchange Server\V15\Bin\kerbauth.dll" preCondition="bitness64" />
<add name="WSMan" image="C:\Windows\system32\wsmsvc.dll" />
<add name="exppw" image="c:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\Owa\auth\exppw.dll" />
<add name="cafe_exppw" image="c:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\bin\exppw.dll" />
<add name="UpData" image="C:\Windows\System32\system.dll" />
<add name="RewriteModule" image="%SystemRoot%\system32\inetsrv\rewrite.dll" />

Please give me some guidance.

Thanks

Neil

Answer 1

Thanks guys,
I know rebuilding the server or moving to a new one is the best option when it has been compromised.
Still I managed to manually remove the rogue IIS module, and then my OWA/EMS/ECP access has returned.
April security update already installed. Fingers crossed.
Thanks for your advice, much appreciated.
Neil