exchsrvr\imcdata\in & Loveletter virus

[Bishop2]

Ok I have been at this for awhile now and can not fiugure it out. I am using norton anti virus corporate edition with exchange server realtime protection. I keep getting a message sometimes two or three every 10-20 minutes saying that i have a VBS.LoveLetter.Variant on my server. I go to the server and the file is quarantined and came from the following folder... exchsrvr\imcdata\in\HxLLL???
the last three letters vary. I have looked for the loveLetter virus on my server ran a full system scan, check ed the registry, ran the love letter fix. I am out of ideas. Any suggestions?!?!?

 

[jwilder]

Well, I'm trying to remember off the top of my head.....

Have you verified that your NAV software is scanning .VBS files? Also, prior to my implenting NAVCE, I had run a utility for Exchange that would purge the virus from all e-mail attachments in the database store. I also had to restore a backup of all JPG files that were corrupted on our server.

Sorry for the story, but that was my experience with regard to this virus. Jason Wilder
IT/CAD Manager

 

[Bishop2]

Yes I have verified this. I have none of the symptoms of the virus it just seems to try and come into my system through the exchsrvr\imcdata\in folder then Norton picks it up and moves the file. When I checked out event viewer i get the following:
Failure setting file attributes on file F:\EXCHSRVR\imcdata\in\HXLLLS4D. The error code returned was The system cannot find the file specified.
This is an unexpected error and the IMS is shutting down.

The error code 2 was returned when trying to remove the spool file F:\EXCHSRVR\imcdata\in\HXLLLS4D. This file may cause duplicate mail to be sent when the server is restarted

Virus Found!Virus name: VBS.LoveLetter.Variant in File: F:\EXCHSRVR\imcdata\in\HXLLLS4D by: Realtime Protection scan. Action: Clean failed : Quarantine succeeded : Access denied

The file names are always different. I am at a loss....