Five steps to cleaning a virus-infected Exchange server

Cleaning a virus-infected server is easy for value-added resellers (VARs) and security consultants who follow these five steps, courtesy of SearchSecurity.com.

There are countless articles on how to prevent email virus infections, but almost nobody talks about how to clean up a massive infection. Of course, you want to update your server's file-level and Exchange-level antivirus software, and make sure all users have up-to-date antivirus applications running on their desktops.

But sometimes these steps are not enough. If your server is heavily infected, the sheer volume of infected messages can overwhelm the machine and your antivirus software may not be able to keep pace with the server. If you find yourself in a situation like this, here are the steps you need to take.

Stop the flow of SMTP traffic

First, cut off communications between your mail server and the Internet. This will prevent your server from spewing infected messages to the outside world and stop any new messages from arriving until you've recovered from the infection.

One way of stopping the flow of SMTP traffic is to configure your organization's SMTP connector to not deliver mail:

1. Open Exchange System Manager and navigate through the console tree to Administrative Groups -> your administrative group -> Routing Groups -> First Routing Group -> Connectors -> your SMTP connector.

2. Right click on your SMTP connector and select Properties.

3. Now choose the Delivery Options tab.

4. Pick the Never Run option from the Connection time dropdown list.

While you are at it, you might also consider disabling the SMTP virtual server:

1. Navigate to Administrative Groups -> your administrative group -> Servers -> your server -> Protocols -> SMTP -> Default SMTP Virtual Server.

2. Right click on the Default SMTP Virtual Server object and select the Stop command.

Keep users out ...

To read more you must become a member of SearchSecurityChannel.com

As an existing member of the TechTarget network please activate your SearchSecurityChannel.com account 

By joining SearchSecurityChannel.com you agree to receive email updates from the TechTarget network of sites, including updates on new content, magazine or event notifications, new site launches and market research surveys. Please verify all information and selections above. You may unsubscribe at any time from one or more of the services you have selected by editing your profile or unsubscribing via email.

TechTarget cares about your privacy. Read our Privacy Policy

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Malware protection and defense strategies Trend Micro's Worry-Free Business Security 6.0 extends partner opportunities SenSage tapped to participate in McAfee's Sales Teaming Program Agilex partners with HBGary to offer security forensic, assessment services What is the future of antivirus or antimalware software? Checklist: Five steps to assessing a customer's antivirus protection Top security book excerpts of 2007 Virtual honeypots: Tracking botnets Tracking botnets Defending against bots Case studies Information Security Threats Mitigating zero-day vulnerabilities in customers' environments Getting to know the NERC CIP standards UTM appliances bundle security, give VARs multiple revenue streams Remote vulnerability scanning: Process, roles and responsibilities Data breach prevention techniques: Helping customers avoid data breaches Full disk encryption: A hot opportunity for VARs Top security tips for solutions providers Common injection attacks Checklist: Five steps to assessing a customer's antivirus protection Polymorphic malware attacks and in-line scanning Viruses and Other Malware Re-route virus traffic to the bit bucket Email security options for SMBs

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

of Exchange

In some cases, you may also need to keep the users out of the Exchange server while you disinfect it. The easiest way to do this is to unplug the network cable from the server. This will guarantee that nobody can send or receive anything until you are ready for them to do so.

Freeze your message queues

Now it is time to begin cleaning out the message queues. To do so, you must freeze the queues and then delete the undesirable messages.

1. To freeze a queue, navigate through the Exchange System Manager console to Administrative Groups -> your administrative group -> Servers -> your server -> Queues.

2. The console's detail pane will display a list of the server's queues. Right click on the queue containing the offending messages and select the Freeze command. (Keep in mind that X.400 queues can't be frozen.)

If you want to freeze all the queues, simply click the Disable Outbound Mail button (click Enable Outbound Mail to re-enable mail flow).

Locate and remove infected messages

To locate infected messages and remove them from the queues:

1. Click the Find Messages button.

2. The easiest way to spot an infected message is usually by its subject line. Unfortunately, the Find Messages feature doesn't allow you to search by subject line. Instead, enter a large number (such as 100,000) into the Number of Messages to Be Listed In the Search field.

3. Set the Show Messages Whose State Is option to All Messages and click Find Now.

4. The result is that all of the messages in the queue will be displayed. You can then sort the results by subject line to make finding the infected messages easier.

5. Finally, select and right click on the infected messages and select Delete (No NDR).. The infected messages will be deleted from the queue.

6. Repeat the procedure on the remaining queues.

Even after all of the queues have been disinfected, there is a very good chance that some of the mailboxes on your server contain infected messages. Exchange doesn't offer any easy mechanism for manually disinfecting everyone's mailboxes. Your best option is to scan the mailboxes with an Exchange aware antivirus program. You should do this prior to allowing the users back onto the server.

Return Exchange to a functional state

The last step in the process is to bring the server back to a functional state:

1. Enable mail flow and unfreeze any frozen queues.

2. Enable the SMTP Virtual Server and set the connection time for your SMTP connector back to Always Run.

3. Plug the network cable back in to allow users access Exchange once again.

About the author
Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server and IIS. Brien has served as the CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. As a freelance technical writer he has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies.

This tip originally appeared on SearchSecurity.com.