RE: Exchange Issues
Depends entirely on which virus. Is it running around in the store right now? Do you have Symantec AV Exchange flavor on the system? -Original Message- From: Henry, Christopher M. [mailto:[EMAIL PROTECTED] Sent: Thursday, November 06, 2003 9:50 AM To: Exchange Discussions Subject: Exchange Issues Ok I am in a jam here, due to bad decision making and all of the above I have the following task: Our main Exchange and ADC server is infected with a virus(don't ask me how, I will just leave it as upper management) Is there any easy way of cleaning the virus off the machine, I am using Symantec corporate and enterprise editions. How would you guys recommend I clean this virus? Would you recommend to boot the machine in safe mode and do a full scan? Or is it a bit harder than that... _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Exchange Issues
Right. Is this an email virus (infected store), or a file system virus? -Original Message- From: Arlo Clizer [mailto:[EMAIL PROTECTED] Sent: Thursday, November 06, 2003 9:44 AM To: Exchange Discussions Subject: RE: Exchange Issues Depends entirely on which virus. Is it running around in the store right now? Do you have Symantec AV Exchange flavor on the system? -Original Message- From: Henry, Christopher M. [mailto:[EMAIL PROTECTED] Sent: Thursday, November 06, 2003 9:50 AM To: Exchange Discussions Subject: Exchange Issues Ok I am in a jam here, due to bad decision making and all of the above I have the following task: Our main Exchange and ADC server is infected with a virus(don't ask me how, I will just leave it as upper management) Is there any easy way of cleaning the virus off the machine, I am using Symantec corporate and enterprise editions. How would you guys recommend I clean this virus? Would you recommend to boot the machine in safe mode and do a full scan? Or is it a bit harder than that... _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Exchange Issues
Just to clarify: Is it a single box that acts as both ADC and Exchange or is it two boxes? First thing is to isolate the server from the network and especially from the Internet so that no further damage is done and that the virus is not spread any further. What virus? This will determine which AV product to use and what procedures you will need to follow. If it's an email virus, you need an Exchange-aware virus scanning product (do *NOT* scan the Exchange Store files, *.EDB files, *.STM files, or the M: Drive with a normal file-based AV product!!). If it's a non-email virus scan the HD (excluding the Exchange directories and data). If you have the appropriate AV software for the type of virus, you should be able to scan the server without it being in Safe mode. -Original Message- From: Henry, Christopher M. [mailto:[EMAIL PROTECTED] Sent: Thursday, November 06, 2003 12:50 PM To: Exchange Discussions Subject: Exchange Issues Ok I am in a jam here, due to bad decision making and all of the above I have the following task: Our main Exchange and ADC server is infected with a virus(don't ask me how, I will just leave it as upper management) Is there any easy way of cleaning the virus off the machine, I am using Symantec corporate and enterprise editions. How would you guys recommend I clean this virus? Would you recommend to boot the machine in safe mode and do a full scan? Or is it a bit harder than that... Chris _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchanget ext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Exchange issues
If you don't know (1) what virus you have, (2) how it got there, (3) how to get rid of it, or (4) how to prevent this in the future, I suggest you hire a security consultant. In addition to fixing the problems, make sure he trains you. Ed Crowley MCSE+Internet MVP Freelance E-Mail Philosopher Protecting the world from PSTs and Bricked Backups!T -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Henry, Christopher M. Sent: Friday, September 12, 2003 9:55 AM To: Exchange Discussions Subject: Exchange issues Sorry for the double post, but this has more info... I have a problem that is affecting two users on my network, and I cannot figure it out...maybe someone here can help. Outlook on both computers takes about 30 seconds to send and email to people outside of our domain and sometimes to people inside our domain. For everyone else email works fine. Any suggestions on what it might be? Could it be something local or something at the server level? Both computers are fully patched, both windows and Office service packs are installed and all updates applied. We are using Office XP and Exchange 2000. I Am not sure if this has anything to do with the issue, but I recently took our old NT4 domain offline and deleted the trust between both server. Thank for your help Christopher H. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Exchange Issues
This is a file system virus, I have scanned the information store and that is clean. This is and Exchange an Active Directory machine which is very critical. I have not identified the virus as yet, but I know its there... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Martin Blackstone Sent: Thursday, November 06, 2003 12:45 PM To: Exchange Discussions Subject: RE: Exchange Issues Right. Is this an email virus (infected store), or a file system virus? -Original Message- From: Arlo Clizer [mailto:[EMAIL PROTECTED] Sent: Thursday, November 06, 2003 9:44 AM To: Exchange Discussions Subject: RE: Exchange Issues Depends entirely on which virus. Is it running around in the store right now? Do you have Symantec AV Exchange flavor on the system? -Original Message- From: Henry, Christopher M. [mailto:[EMAIL PROTECTED] Sent: Thursday, November 06, 2003 9:50 AM To: Exchange Discussions Subject: Exchange Issues Ok I am in a jam here, due to bad decision making and all of the above I have the following task: Our main Exchange and ADC server is infected with a virus(don't ask me how, I will just leave it as upper management) Is there any easy way of cleaning the virus off the machine, I am using Symantec corporate and enterprise editions. How would you guys recommend I clean this virus? Would you recommend to boot the machine in safe mode and do a full scan? Or is it a bit harder than that... _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=; lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
