Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

W32.Netsky.Q@mm.enc in Microsoft Small Business Server, Exchange Queue Location: How to remove?

Posted on 2008-06-16
6
Medium Priority
?
300 Views
Last Modified: 2013-12-09
I have a Windows Small Business Server 2003 SR2 that has an infection from W32.Netsky.Q@mm.enc virus that has been found by Symantec Antivirus Corporate Edition. The virus can't be deleted is the problem. Antivirus attempts to delete or quarentine the infected file and both fail due to "access is denied".

The virus is in the following location:
C:\Program Files\Exchsrvr\Mailroot\vsi1\Queue\

The infected file is:
C:\Program Files\Exchsrvr\Mailroot\vsi1\Queue\NTFS_c728f24201c8cdf0000024ff.EML

Here's Symantec information about this.

http://www.symantec.com/security_response/writeup.jsp?docid=2004-033015-2404-99&tabid=1

I've followed all the instructions but in rescanning the virus does not later appear. Then a few days later it will appear as a new Symantec virus alert. It's driving me crazy that I can't seem to permanently remove and protect the server from these virus. Why isn't Symantec able to delete this... anyway.

I've also run programs like Spybot but it isn't detected in that version.

Any suggestions on what I can do to remove this virus would be really helpful.



Symantec-Notices.jpg
0
Comment
Question by:tedjpclark
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 25

Expert Comment

by:kieran_b
ID: 21798233
Step one, uninstall symantec anti-virus from the exchange server.
Step two, get an exchange aware anti-virus program.
0
 

Author Comment

by:tedjpclark
ID: 21798658
What do you recommend I use as an Exchange Aware Anti-Virus?
0
 
LVL 25

Expert Comment

by:kieran_b
ID: 21798696
If you must use Symantec, get Symantec Mail Security for Microsoft Exchange - Personally, I think most of their stuff is rubbish, and remove it everywhere i can.  That said, I think any client AV on an exchange server (non-exchange aware) has no place.

Other options are Trend Micro's suite, which I have heard a lot of good things about.

Personally, I don't use AV on Exchange servers at all - I block it at the gateway and at the client.
0
2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

 

Author Comment

by:tedjpclark
ID: 21798797
OK Thanks. I'm of like mind with Symantec, but with this server I'm unfortunately picking up what somebody else built. The office I'm supporting believes "we've got AntiVirus, we paid for Symantec", when I initially reviewed things and provided recommendations last fall. Nothing better than eventually being able to say "told you so", of course after I've had to spend hours and hours fixing this server, problem by problem.

So I'm now going through and cleaning this computer up. I'm curious, since it would help me resolve so many potential issues with this system, what do you do specifically to block virus/malware at the gateway and client? Any links or suggested reading would be appreciated. Thanks.
0
 
LVL 25

Expert Comment

by:kieran_b
ID: 21798915
On the gateway, I will install something like GFI MailSecurity on/or an application device/server or use only an SPI compliant router which can actually catch it at the router - Sonicwalls do it, FortiGates do it - depending on the site, budget, etc.

On the client, I always use something - personally, I don't use AV, but I think it is irresponsible to expect users to get along with out it.  I have used and like AVG from GRISoft.com, I have heard good reports of McAfee and Trend Micro.
0
 
LVL 25

Accepted Solution

by:
kieran_b earned 1000 total points
ID: 21798932
I will clarify a bit more about the problem as well;

What is happening is that AV infected emails are coming into your server bound for your users.  Symantec is misconfigured, but any AV app misconfigured on an Exchange server will do the same thing (particularly if it is no Exchange aware) - it is seeing the messages in the queue and trying to clean them.  Now, Exchange is working with them, and Exchange doesn't take crap from AV software, so it just locks the files and Symantec has a teary.

The real problem is, with Symantec doing that, it is only a matter of time before it upsets Exchange so much that it either corrupts messages or worse, the information store (which I have actually seen...)
0

Featured Post

WEBINAR - Latest Cyber Tips for Defense

Join the WatchGuard Threat Research Team on October 26th for an informative webinar featuring expert tips and tricks for defending your organization from today's latest cyber threats. Don't leave yourself vulnerable to attack. Register for the webinar today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The core idea of this article is to make you acquainted with the best way in which you can export Exchange mailbox to PST format.
Are you looking for the options available for exporting EDB files to PST? You may be confused as they are different in different Exchange versions. Here, I will discuss some options available.
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question