Maybe the SCR target event log was generating errors on 1 particular log precisely because you have scanning enabled on the log files folder, the and the AV software was not allowing exchange to process the file correctly...maybe.
From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: woensdag 18 augustus 2010 14:42 To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 SCR replication logs infected with trojan The long and the short of it is - you can't. You also can't be certain that, even now, the log is actually infected. It's very common for things like this to be false positives. Generally speaking you want perimeter scanning (i.e., scanning of incoming and outgoing e-mail in your DMZ) and you want desktop scanning (to ensure that your e-mail submitters aren't submitting malware to Exchange). It used to be that we also would recommend store/transport level scanning; but that's no longer considered a best practice. The bigger an Exchange database gets, the more challenging that is to do performantly. The real question to consider is this: ok, you have an email with a Trojan sitting in your mailbox database. That means it will exist in a at least two places - a log file and the database itself. If you have an CR technology, it'll also exist in another log file and database on the target machine. What can that Trojan do? The answer is: nothing. Absolutely nothing. If a user happens to activate the Trojan, it can conceivably impact the user's workstation. But the AV on the workstation should catch it. If you want it gone from the store so that a user never has a chance to activate it - you have to do store level scanning. And that typically is an add-on package from an AV vendor. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Liby Philip Mathew [mailto:lmat...@path-solutions.com] Sent: Wednesday, August 18, 2010 7:50 AM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 SCR replication logs infected with trojan Thanks Mike, My SCR target event log was generating errors on 1 particular log. So I went to the source and scanned that particular log file with McAfee without cleaning/repairing option and it detected the Trojan. I have followed the link long back and excluded the required files from scanning. I'll go thru it once again. But how can I make sure that the logs or DB's are not infected with Trojans or virus. TIA Liby From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Wednesday, August 18, 2010 2:34 PM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 SCR replication logs infected with trojan You should not be scanning the log files. Ever. Exclude that directory and remove all the log files from quarantine, restoring them to their original location. See <http://theessentialexchange.com/blogs/michael/archive/2010/06/16/antivirus-exclusions-and-windows.aspx> and the articles linked from that article, especially <http://technet.microsoft.com/en-us/library/bb332342(EXCHG.80).aspx> Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Liby Philip Mathew [mailto:lmat...@path-solutions.com] Sent: Wednesday, August 18, 2010 6:24 AM To: MS-Exchange Admin Issues Subject: Exchange 2007 SCR replication logs infected with trojan Hi, I have a SCR replication log file infected with a Trojan which is not replicating to the SCR target. McAfee identified it as a JS/Redirector.z on the source. How can I get rid of this Trojan without deleting the log so that the SCR replication will continue? How can I avoid future infection to the logs? Regards Liby ________________________________ Disclaimer [The information contained in this e-mail message and any attached files are confidential information and intended solely for the use of the individual or entity to whom they are addressed. This transmission may contain information that is privileged, confidential or exempt from disclosure under applicable law. If you have received this e-mail in error, please notify the sender immediately and delete all copies. If you are not the intended recipient, any disclosure, copying, distribution, or use of the information contained herein is STRICTLY PROHIBITED. Path Solutions accepts no responsibility for any errors, omissions, computer viruses and other defects.] DISCLAIMER 18-8-2010 15:20:41 This communication is intended only for use by MS-Exchange Admin Issues. It may contain confidential or privileged information. If you receive this communication unintentionally, please inform us immediately. Thank you. 180 has registered companies in the United States and in the Netherlands. 180 Los Angeles LLC . (180) 1733 Ocean Avenue, Suite 400, Santa Monica, California 90401, is registered with the trade register in the US in Delaware under file number 4260284 and the corporation's FEIN is 20-5982098. 180 Amsterdam BV (180) Herengracht 506, 1017 CB, Amsterdam is registered with the trade register in the Netherlands under number 34253037 and VAT number NL8161.54.673.B.01. The content of this communications is not legally binding unless confirmed by letter or telefax. Please note that 180 is neither liable for the proper transmission nor for the complete transmission of the information contained in this communication or for any delay in its receipt. Also please note that the confidentiality of email communication is not warranted. All services and other work provided by 180 are subject to our general conditions (supplier terms and conditions). The conditions are available for inspection at Herengracht 506, Amsterdam and at the Chamber of Commerce in Amsterdam. If you wish to receive a hard copy of these conditions, please send an e-mail with your address to i...@180amsterdam.com<mailto:i...@180amsterdam.com> In the event you send to 180 any unsolicited ideas and/or materials (whether consisting of texts, images, sounds, software, information or otherwise) ("Materials") by e-mail or otherwise, 180 shall be entitled to use, copy and/or commercially exploit such Materials to the fullest extent, free of charge and 180 will not be bound by any confidentiality obligation in respect thereof.