Mcafee, Norton, and Kaspersky with the appropriate switches will all find
the virus in the user files.
Norton will actually clean it, but I'm not sure how it would clean the MIME
format file. If it does anything that changes the size of the message, it
would make the index useless - effectively killing the mailbox. The imail
mailbox format appears to be a fairly standard format though, and Norton may
be smart enough to deal with it(but I still wouldn't trust it without
EXTENSIVE testing).
One alternative would be to use a POP3/IMAP control write a script to
iterate through all user's boxes and delete the messages in question. User
passwords can be retrieved from SQL or iMail databases, but not from NT SAM.
All you'd have to look at is the header, assuming you know the "From" and
"Subject".
The other would be deal with the Mailbox file directly, I've done mass
search/replace with the DOS version of Norton FileFind routinely and very
effectively(never on imail MailBox files, but on other text and binary
files). You could probably do a Search/Replace on the Subject(Make it a
warning), the MIME attachment header(change the file name/type to something
non-executable) , and enough of the encoded attachment text to disable it.
Just make sure the Search and Replace strings are _IDENTICAL_ identical
lengths.
The Norton Filefind(or similar utility) Search/Replace may be the easiest to
implement. It's also the most dangerous. Have backups on hand.
Jerry
----- Original Message -----
From: "Adam Greene" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, December 21, 2000 7:31 PM
Subject: [IMail Forum] deleting virus in ALL users' files!
> Hi!
> Does anyone know how to delete a specific message from all of my users'
> directories? Perhaps a WindowsNT batch file that searches all files on a
drive
> for a specific text string and then deletes a predefined text string from
all
> found files?
>
> Here's the situation:
> We sent a bulk email to all of our users using an Imail mailing list.
Evidently
> we were not careful to restrict who could post to the list.
> A customer who received our email had the Hybris virus, which caused his
machine
> to send out an email to the mailing list address. As a result, ALL of our
> customers received the virus.
> We have set up a rules.ima file to delete all further occurrences of the
virus.
> We would like to search all the main.mbx files of our customers for the
virus
> attachment and then delete the attachment and message, without affecting
our
> customers' other messages!
>
> Any input is definitely welcome!!
>
> Thank you,
> Adam Greene
>
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
