Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Netsky 1

Status
Not open for further replies.

Animasu

Technical User
Aug 5, 2005
23
GB
Hi, i keep getting these virus emails from the server warning me about a infected file
----------------------------------------------------------
The file C:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_be14299401c5c44300000a73.EML is infected with W32/Netsky.p.eml!exe Virus. Unable to clean the file using the current Scan engine version 4.4.00 DAT version 4.0.4590.(from MAILHOST IP 217.45.249.49 user NT AUTHORITY\SYSTEM running NetShield 4.5 OAS)
----------------------------------------------------------
The virus scanning software is McAffee, i never useually have any problems with it, and is often reliable but im kinda at a stuck end here, Also ive downloaded a couple of Netsky virus removers (Microsofts and Synamatics) but they have both said that the system isn't infected, it dosent seem any differant from what it has been but this just keeps popping up every nown and then, the virus scanning is as up-to-date as possiable as well, Just wondering if anyone knew if there is anything i can do, due to i don't want the whole network being affected.
Hope someone can help
Thanks
James
 
The removal tools wont remove the infection as the server itself isn't affected, the virus sortware seems to be indicating that a message in the exchange store is infected. I'm not an Exchange expert so i'm not sure how to go about it but deleting the infcted email would probably solve the problem.
 
Curious, did you follow all required steps for the removal tool? Other words, did you disable shadow copy before running removal tool? If not, the virus may still be resident even if the removal tool states that it removed the infected file.

Hope This Helps,

Good Luck!

(I do what I can with what I know)
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top