Please let others know how useful this tip is via the rating scale at the end of it. Do you have a useful Exchange or Outlook tip, timesaver or workaround to share? Submit it to our tip contest and you could win a prize.
There are countless articles on how to prevent e-mail virus infections, but almost nobody talks about how to clean up a massive infection. Of course, you want to update your server's file-level and Exchange-level antivirus software, and make sure all users have up-to-date antivirus applications running on their desktops.
But sometimes these steps are not enough. If your server is heavily infected, the sheer volume of infected messages can overwhelm the machine and your antivirus software may not be able to keep pace with the server. If you find yourself in a situation like this, here are the steps you need to take.
Stop the flow of SMTP traffic
First, cut off communications between your mail server and the Internet. This will prevent your server from spewing infected messages to the outside world and stop any new messages from arriving until you've recovered from the infection.
One way of stopping the flow of SMTP traffic is to configure your organization's SMTP connector to not deliver mail:
While you are at it, you might also consider disabling the SMTP virtual server:
Keep users out of Exchange
In some cases, you may also need to keep the users out of the Exchange server while you disinfect it. The easiest way to do this is to unplug the network cable from the server. This will guarantee that nobody can send or receive anything until you are ready for them to do so.
Freeze your message queues
To continue reading for free, register below or login
To read more you must become a member of SearchExchange.com
>
Now it is time to begin cleaning out the message queues. To do so, you must freeze the queues and then delete the undesirable messages.
If you want to freeze all the queues, simply click the Disable Outbound Mail button (click Enable Outbound Mail to re-enable mail flow).
Locate and remove infected messages
To locate infected messages and remove them from the queues:
Even after all of the queues have been disinfected, there is a very good chance that some of the mailboxes on your server contain infected messages. Exchange doesn't offer any easy mechanism for manually disinfecting everyone's mailboxes. Your best option is to scan the mailboxes with an Exchange aware antivirus program. You should do this prior to allowing the users back onto the server.
Return Exchange to a functional state
The last step in the process is to bring the server back to a functional state:
About the author: Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server and IIS. Brien has served as the CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. As a freelance technical writer he has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies. You can visit Brien's personal Web site at http://www.brienposey.com.
Do you have comments on this tip? Let us know.
Related information from SearchExchange.com:
Tip: How to combat e-mail viruses
Dos and Don'ts: Scanning Exchange for viruses
Exchange Admin 101: Attachment blocking
Reference Center: Exchange virus protection
