Solved

Exchange 2000 virus recovery HELP

Posted on 2009-05-13
4
302 Views
Last Modified: 2013-11-22
I have Exchange 2000 installed which was recently hit with some virus's.  Kaspersky found email -worm Win32.Klez and many trojans in Exchsrvr\Mailroot\Vsi\Badmail.  Kaspersky reorts that the threats have been nuetralized, but upon reboot, detects the threats over again.  I have tried to delete all files in the badmail folder, but can not access it.  Also, I can not start the information store service because I can not start the system attendant service.  I keep getting a 1053 error:The service did not respond to the start or control request in a timely fashion.

I have run another Kaspersky virus program targeted for the Win32.Klez  virus which was command based.  It found the virus and instructed me to rebott to nuetralize.  Yet on reboot, Kaspersky again finds the threat.

Can anyone offer any advice as to how I should proceed?
0
Comment
Question by:Cicio1412
  • 2
4 Comments
 
LVL 65

Accepted Solution

by:
Mestha earned 500 total points
Comment Utility
Stop all of the Exchange services.
Stop all of the AV services.
HARD DELETE the badmail directory (SHIFT DEL).

Then restart the Exchange services. Exchange will recreate the directory if it is required.

If you cannot stop the AV then exclude the directory from the realtime scan.

Simon.
0
 

Author Comment

by:Cicio1412
Comment Utility
I was able to finally delete the Badmail folder contents via a command line.  So now the folder is empty.  However, I still can not start any of my exchange services.  I still get the 1053 error:The service did not respond to the start or control request in a timely fashion whe I try to start the system attendant.
0
 
LVL 65

Expert Comment

by:Mestha
Comment Utility
That may well be something completely unrelated.
Something should be logged when the service tries to start.

Simon.
0
 
LVL 15

Expert Comment

by:xmachine
Comment Utility
Hi,

Check this:

http://support.microsoft.com/kb/886695



Experts-Exchange Certified Anti-Virus Master
Experts-Exchange Certified Symantec Anti-Virus Master
Symantec Certified Specialist
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now