Windows

do you mean that the minute you enable the SMTP service [SMTP virtual server], there is a outbound ICMP broadcast?

I assume that the scans were done in safe mode? Some of the malware can hide itself from a scan in "normal mode"

While I have a prompt open, and this can be on any machine in the office, pinging an IP address on the internet if I stop the smtp services pinging returns to normal. Start it and the latency returns.

The server was scanned in safe mode and is not used for internet surfing. In addition the event logs are clean.

ok is this what happens: From a command prompt on any machine,with the SMTP service running on Exchange, when you initiate a ping request to a public address the latency or return reply is 2500ms. When you disable the SMTP service, the latency on a ping request reply is oh 25ms or 128ms?

Yes that is correct.

Have you thoroughly checked your workstations to make sure that there is not an email virus or trojan on one (or more) of them that is using your SMTP service?

Hi

i too have the exact same problem and i cannot work out weather the problem originates from internal or external. i do know that when i unplug the LAN the problem continues. im thinking internal. but the problem is no where on the internet.