Hello All, I have a couple of clients who are using InoculateIT (aka EjaculateIT) & the Exchange Agent and they got infected with the Goner virus last week. These clients mainly got infected because they didn't have the latest virus definitions because the virus came out before the definitions were updated. Anyway, the clients who didn't have the updated virus definitions were updated and a full scan was performed. On each of these clients, I noticed it only caught one instance of the Goner virus which it found in the administrator mailbox. It deleted the attachment but I noticed there was more than one infected message in that mailbox that it didn't touch; there were also dozens of other mailboxes with infected messages that it didn't catch or touch as well. Anyway, my idea was to use Exmerge to extract all messages with Hi in the subject and with an attachment of gone.scr. I ran Exmerge and it did remove the messages but I noticed some of the PST's that it created were extremely large. those large PST's were opened in Outlook and messages that I didn't want extracted had been extracted. All the uninfected items that I didn't want extracted had some form of word hi in the subject (eq: China). I had to manually delete the infected messages and move the uninfected messages back into each individual mailbox. I also changed the criteria for Exmerge to only pull messages with attachments of gone.scr and no subject and it seems like the same thing happened. Is there a way to have Exmerge only move messages of an exact subject that I define. Also, can Exmerge move items from public Folders? I noticed certain public folder have the infected item within them and I would like to have them removed as well. Any help would be appreciated. TIA!!!
List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
