RE: Trend Removed the priv1.stm file, exchange is not working!

From: Ray Fong [MSFT] (rayfong_at_online.microsoft.com)
Date: 08/10/04 

Date: Tue, 10 Aug 2004 19:35:47 GMT

My advices are

1. Restore Exchange Mailbox Store from tape
2. Contact PSS to perform recovery to prevent further damage

If you want to try to do it yourself, I would first stop the MSexchangeIS,
then make a complete backup of the MDBDATA folder(s) <Including the *.edb,
*.stm, *.log, and *.chk). Next, run eseutil /ml on both priv1.edb and
pub1.edb, and then eseutil /ml on e00.log. Post back the result and let see
what we can do.

I strongly recommend you to contact PSS if you want to soft recovery the
data and the matter is urgent.

Ray Fong
Microsoft SBS Product Support

This posting is provided "AS IS" with no warranties, and confers no rights.

>
>I did a manual scan of the server and the officescan client found netsky p
>viruses in the priv1.stm file.
>
>So it took the file and remove it from the exchange folder and moved it to
>a suspect files folder.
>
>I tried copying the file back and use the recovery utility eseutil, but I
>keep getting error messages.
>
>One that the file is locked, another saying the slv header info is corrupt.
>Has trend modified this file in any way or just moved it?
>
>Is there any way to recover it?
>
>I tried to follow MS KB313184
>
>Please any help would be great.
>
>
>

Relevant Pages

  • Re: Burn to Death
    ... You would be hard pressed to find an MVP who hasn't talked to PSS at ... recovery testing scenarios. ... to recover the death DCs the tape is 1 week old. ... DC1 - Domain Controller and Exchange Server - and DFS. ...
    (microsoft.public.exchange.admin)
  • Re: disaster recovery/decryption? Possible?
    ... Shawn - Does PSS do data recovery from reformatted, ... >>> Dog House Dwelling, ...
    (microsoft.public.win2000.security)