Worm Email HELP!!!

[goldenboiyaj]

Hi, I need help. I have 2 servers. server1 is the DC and server2 is my email server which runs exchange 2003. both servers are on windows server 2003. I run symantec mail security for microsoft exchange. I have SonicFirewall.

I keep getting hit with w32.sober.X@mm!zip mass worm virus on server2. I have the most updated version of symantec antivirus. It detects the worm and deletes/quaratines it. I ran the delete tool from symantec also, does that same thing. The location is of them is "c:\windows\temp". It looks like my exchange2003 has a hole in it and it's letting in these emails with the worm or else i still have the worm. Is there a way to delete the extension? any settings I should look at on my server2k3 or exchange2k3?

thanks
ky

 

[markdmac]

Totally a personal preference, but I hate Symantec AV and find TrendMicro to work better and be MUCH easier to manage.

I hope you find this post helpful.

Regards,

Mark

 

[fs483]

Same here. I prefer a combination of Norman Virus Control with Sybari Antigen for exchange. Now in your case, try to disconnect your lan links for the servers, scan and clean the servers. Then start reconnecting the DC, scan again. Maybe your virus is coming from another computer on the LAN. One way I used to solve a huge virus infection in one network was to disconnect every single computer from the network (disconnected everything from the patch panel or switch). Install a copy of Zone Alarm (that I carry with me all the time and downloaded from a clean computer previously). Once Zone Alarm is installed, I scan the computer with it's anti-virus. Then I reconnect the computer to the Internet and see if any weird connexions are attempted towards the outside. If so, then the computer is still infected and proceed with more cleaning (downloading removal tools from my laptop that's clean). Once I'm sure the computer is cleaned (and fully patched), then I proceed with another computer. If the computer keeps on trying to connect outside, then I isolate that computer and format/reinstall.

 

[E1Designs]

Ky if it is showing up in the Event Viewer, go download

http://www.ewido.com

and run the trial, delete what needs to be deleted then try things out. The virus will be seen multiple times on inbound emails also. Each time Symantec locates it, it will give you a display/warning and then delete it.