Re: Exchange 2000/SAV/Download.Trojan Problem

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Sam (sam_nospam_at_nospam.com)
Date: 09/18/04 

Date: Sat, 18 Sep 2004 19:00:37 -0400

No errors or any other alerts in there..

"Andy David - Exchange MVP" <adavid@pleasekeepinngcheesebucket.com> wrote in
message news:53dpk0l4o8l96qaciutre4a0ndt5lr2a7f@4ax.com...
> Anything in the event logs?
>
>
>
>
> On Sat, 18 Sep 2004 08:51:58 -0400, "Sam" <sam_nospam@nospam.com>
> wrote:
>
>>I excluded them from the "File Real time protection" and "Scheduled
>>Scans",
>>based on an article I found at Symantec web site
>>
>>
>>"Andy David - Exchange MVP" <adavid@pleasekeepinngcheesebucket.com> wrote
>>in
>>message news:v96nk05p1plvh6l31upu8rgp431o76vcer@4ax.com...
>>> Are you scanning the exchsrvr dirs or the M: drive?
>>>
>>>
>>>
>>> On Fri, 17 Sep 2004 22:05:05 -0400, "Sam" <sam_nospam@nospam.com>
>>> wrote:
>>>
>>>>I have Exchange 2000 server running on Windows 2000. I also have
>>>>Symantec
>>>>Antivirus Corporate Edition (server edition) running on the server.
>>>>Lately,
>>>>I've been getting information message from SAV that Download.Trojan was
>>>>found on the Temp directory. In the "Action Taken" line it says: "Clean
>>>>failed : Delete succeeded : Access denied". After that, Exchange server
>>>>stop
>>>>sending and receiving emails. I have to reboot the server, or restart
>>>>exchange services to make it work again.
>>>>I searched the web and followed many suggestions: -
>>>>1) I tried rebooting the system in safe mode and run virus scan ->
>>>>nothing
>>>>was found
>>>>2) I downloaded spyware software and did not find anything
>>>>3) I downloaded "HijackThis" and nothing showed up that I don't
>>>>recognize..
>>>>4) I have the latest service packs/updates from Microsoft for Win2K and
>>>>Exchange and latest virus def.
>>>>
>>>>This issue happens at least once a day. Any suggestion what could be the
>>>>problem?
>>>>
>>>>Thanks,
>>>>Sam
>>>>
>>>
>>
>

Relevant Pages

  • Re: Tips on auditing
    ... like www.ipsentry.com $100 US to monitor the event logs. ... IPSentry can send you all sorts of alerts when certain ... you can use a batch file that runs a windows log dumping ... get alerts based on windows security log events. ...
    (microsoft.public.win2000.security)
  • Re: Server Alerts
    ... The only way I know of eliminating them *now*, is to re-install monitoring features, which is a link on the Montioring node of Standard Management. ... I try to ignore the old alerts. ... review the event logs for events related to these services. ... You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad ...
    (microsoft.public.windows.server.sbs)
  • Re: Server Alerts
    ... The only way I know of eliminating them *now*, is to re-install monitoring ... I try to ignore the old alerts. ... review the event logs for events related to these ... Alert Notifications task in the Server Management Monitoring and ...
    (microsoft.public.windows.server.sbs)
  • Event Log Monitoring Tools
    ... I'm looking for a tool that monitors the Event Logs and ... will send alerts when certain events appear in the logs. ... Recommendations? ...
    (microsoft.public.windows.server.general)