Hi,
Thank you for your advice, all who replied. Although this seems incredible, I
and 4 others went one-by-one through all of our users' main.mbx files and
manually deleted the virus from each customer's mailbox. It took us about 5.50
hours (we have about 2000 addresses), but we succeeded!
For the future, I will consider the Norton FileFind option.
Thanks again,
Adam
-----Original Message-----
From: Jerry Murdock <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
Date: Thursday, December 21, 2000 9:35 PM
Subject: Re: [IMail Forum] deleting virus in ALL users' files!
>Mcafee, Norton, and Kaspersky with the appropriate switches will all find
>the virus in the user files.
>
>Norton will actually clean it, but I'm not sure how it would clean the MIME
>format file. If it does anything that changes the size of the message, it
>would make the index useless - effectively killing the mailbox. The imail
>mailbox format appears to be a fairly standard format though, and Norton may
>be smart enough to deal with it(but I still wouldn't trust it without
>EXTENSIVE testing).
>
>One alternative would be to use a POP3/IMAP control write a script to
>iterate through all user's boxes and delete the messages in question. User
>passwords can be retrieved from SQL or iMail databases, but not from NT SAM.
>All you'd have to look at is the header, assuming you know the "From" and
>"Subject".
>
>The other would be deal with the Mailbox file directly, I've done mass
>search/replace with the DOS version of Norton FileFind routinely and very
>effectively(never on imail MailBox files, but on other text and binary
>files). You could probably do a Search/Replace on the Subject(Make it a
>warning), the MIME attachment header(change the file name/type to something
>non-executable) , and enough of the encoded attachment text to disable it.
>Just make sure the Search and Replace strings are _IDENTICAL_ identical
>lengths.
>
>The Norton Filefind(or similar utility) Search/Replace may be the easiest to
>implement. It's also the most dangerous. Have backups on hand.
>
>Jerry
>
>----- Original Message -----
>From: "Adam Greene" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Thursday, December 21, 2000 7:31 PM
>Subject: [IMail Forum] deleting virus in ALL users' files!
>
>
>> Hi!
>> Does anyone know how to delete a specific message from all of my users'
>> directories? Perhaps a WindowsNT batch file that searches all files on a
>drive
>> for a specific text string and then deletes a predefined text string from
>all
>> found files?
>>
>> Here's the situation:
>> We sent a bulk email to all of our users using an Imail mailing list.
>Evidently
>> we were not careful to restrict who could post to the list.
>> A customer who received our email had the Hybris virus, which caused his
>machine
>> to send out an email to the mailing list address. As a result, ALL of our
>> customers received the virus.
>> We have set up a rules.ima file to delete all further occurrences of the
>virus.
>> We would like to search all the main.mbx files of our customers for the
>virus
>> attachment and then delete the attachment and message, without affecting
>our
>> customers' other messages!
>>
>> Any input is definitely welcome!!
>>
>> Thank you,
>> Adam Greene
>>
>>
>>
>> Please visit http://www.ipswitch.com/support/mailing-lists.html
>> to be removed from this list.
>>
>> An Archive of this list is available at:
>> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>>
>
>
>
>Please visit http://www.ipswitch.com/support/mailing-lists.html
>to be removed from this list.
>
>An Archive of this list is available at:
>http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
