Re: [IMail Forum] Slightly OT: Need some server/virus/spyware help

[Dave Riddle]

Have you tried scanning it with the following apps in Safemode to keep most of them from actually running?

This order process of "free" apps has always worked for me even with heavily infected consumer machines used by teenage children. YMMV

I run the applications in this order.  You will need to boot with Safemode with networking to ensure access to the 'net to get the updates signatures for the software.  The "demo" install Webroot is a one shot deal on getting the updates so I normally run it last and hopefully can boot normally by this point.

1. Ad-Aware
2. Spybot
3. Microsoft Anti-Spyware
4. Webroot Spysweeper
5. Hi-Jack This to check for other nasties that are still in startup mode.

Finally I run the free ActiveScan from Panda.  The free version will kill viruses but not Spyware. It will however identify the culprits and the detail report will show you exactly where they are so that you can manually remove them.

At 12:18 AM 8/23/2005, you wrote:

So, it’s 3 something in toe morning and I’m here scanning my mail server for spyware. One of my associates used it to browse some websites and got the sucker infected with all sorts of nasties. I’ve spent the better part of 3 days trying to get this thing clean to no avail. While my software will detect the spyware it cannot completely clean it so the apps become active after a reboot.

I’m considering a server rebuild but I really don’t want to take my only Imail server completely off line for me to wipe the drives and rebuild it from scratch. That will take hours. Oh, it’s a Compaq Proliant 5000 server running Imail 7.15 HF2. Yes, it’s old but it works for us. Is there a way to simply reinstall the OS and perhaps some patches without having to totally reconfigure the server or use the Compaq SmartStart app? I’m betwixt a hard rock and a concrete wall. Oh, this server is also my primary DNS server as well, running SimpleDNS Plus, just to complicate things.

Any help is Greatly appreciated. Feel free to contact me offline.

Thanks!

Troy D. Hilton

Serveon, Inc.

[EMAIL PROTECTED]

302-529-8640

To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/