oh.....and sorry.........forgot...................get a decent e-mail virus scanner on the Exchange server PDQ. -----Original Message----- From: steve alcock [mailto:steve.alcock@xxxxxxxxxxxxxx] Sent: Monday, November 22, 2004 5:30 PM To: [ExchangeList] Subject: [exchangelist] Badmail full[Scanned] http://www.MSExchange.org/ Hi All, I have a friend / customer who's windows 2000 server / exchange server has been attacked by the sdbot virus some weeks ago, he has tried to rid the server but this weekend he called me in to assist as it would not get to the desktop, just a blue background screen, but the network is fully functional. All workstations have been individually checked for any spyware / virus etc and none found. At the server I can run various sdbot killers and get the desktop back I cannot get rid of the virus and I believe it is due to the mailroot / badmail in the exchange server ????? why .......... If I try to view the contents it will not display them, I disconnected the server from the internet ( there is massive traffic whilst connected ) and in command I tried to manually delete the files in the badmail directory, we left it running all day Sunday. Today he informs me that it is still deleting files, but has to connect the server back to the internet so his staff can download e-mails etc, and as soon as he does the hub blinks like mad again. Like I said the network all works fine it is just the server. Can anyone assist me in getting rid of the problem please Many thanks in anticipation. Steve Alcock Calderglen Computers Calder House Spring Lane Colne Lancs BB8 9BD www.calderglen.net phone : +44 (0) 1282 871717 -----Original Message----- From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx] Sent: 22 November 2004 16:41 To: [ExchangeList] Subject: [exchangelist] RE: Contacted by Michael Vella @ IsoftMarketing.com http://www.MSExchange.org/ Yes, it is legit. John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: Lara, Greg [mailto:GLara@xxxxxxx] > Sent: Monday, November 22, 2004 7:58 AM > To: [ExchangeList] > Subject: [exchangelist] Contacted by Michael Vella @ IsoftMarketing.com > > http://www.MSExchange.org/ > > If anyone on this list was contacted by a Michael Vella of > IsoftMarketing.com (the parent company of msexchange.org), requesting name, > address, and telephone number, and can confirm that it's legit, please reply > here or directly to me via email. Thanks. > > Greg Lara > > ------------------------------------------------------------------------ ---- > --------------------------- > This e-mail message may contain privileged, confidential and/or proprietary > information intended only for the person(s) named. If you are not the > intended recipient, please destroy this message, and any attachments, and > notify the sender by return e-mail. If you are not the intended > recipient(s), or the employee or agent responsible for delivering the > message to the intended recipient(s), you are hereby notified that any > dissemination, disclosure or copying of this communication is strictly > prohibited. > ------------------------------------------------------------------------ ---- > --------------------------- > > > > ------------------------------------------------------ > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist > Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp > Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ > ------------------------------------------------------ > Other Internet Software Marketing Sites: > World of Windows Networking: http://www.windowsnetworking.com > Leading Network Software Directory: http://www.serverfiles.com > No.1 ISA Server Resource Site: http://www.isaserver.org > Windows Security Resource Site: http://www.windowsecurity.com/ > Network Security Library: http://www.secinf.net/ > Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com > ------------------------------------------------------ > You are currently subscribed to this MSEXchange.org Discussion List as: > johnlist@xxxxxxxxxxxxxxxxxxx > To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist > Report abuse to listadmin@xxxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSEXchange.org Discussion List as: steve.alcock@xxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to listadmin@xxxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSEXchange.org Discussion List as: simon.bound@xxxxxxxxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to listadmin@xxxxxxxxxxxxxx