Re: Why is MSFax creating temp files - Visible in Windows API, but not in MFT or directory index.
- From: v-robeli@xxxxxxxxxxxxxxxxxxxx (Robert Li [MSFT])
- Date: Tue, 22 May 2007 12:19:39 GMT
Hi Nick,
Thansk for updating.
Before you scan the system with Windows Defender, you need to empty temp
file.
I know you cannot download Windows Defender on server, you can download the
software from a workstation, then copy to server and install it .
Also, since the issue is virus related, you can contact Anti Virus software
manufacture or
Security Company for more help. Thanks for your understanding.
If you need futher assistance, please don't hesitate to let me know.
Best regards,
Robert Li(MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
<From: "Nick" <NoSpam@xxxxxxxxxxx>
<References: <OflcShtmHHA.4848@xxxxxxxxxxxxxxxxxxxx>
<ALs74z1mHHA.5168@xxxxxxxxxxxxxxxxxxxxxx>
<Subject: Re: Why is MSFax creating temp files - Visible in Windows API,
but not in MFT or directory index.
<Date: Mon, 21 May 2007 11:39:52 +0100
<Lines: 137
<X-Priority: 3
<X-MSMail-Priority: Normal
<X-Newsreader: Microsoft Outlook Express 6.00.3790.2826
<X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
<X-RFC2646: Format=Flowed; Original
<Message-ID: <eRUNgR5mHHA.588@xxxxxxxxxxxxxxxxxxxx>
<Newsgroups: microsoft.public.windows.server.sbs
<NNTP-Posting-Host: host81-154-103-121.range81-154.btcentralplus.com
81.154.103.121
<Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:38199
<X-Tomcat-NG: microsoft.public.windows.server.sbs
<
<Robert, thx for your reply.
<
<> 1. Empty out ALL your PC and Browser Temp files and Cache etc.
<Already done that but will do it again. All users (including hidden
system
<users) Local Settings\Temp & Temp Internet files directories deleted as
far
<as possible, that is ok to do that isn't it? Will have to put them back
if
<it isn't.
<
<> Windows Defender Home
<Can't get this bloody Windows Genuine Advantage activeX control to
download.
<We do of course have a fully licenced copy of SBS but this activeX control
<just refuses to work. For this reason I cannot obtain a copy of Windows
<Defender Home at the moment. Any other suggestions how I might obtain a
<copy of this?
<Either way is this really safe to install on an SBS server?
<
<Nick
<
<
<"Robert Li [MSFT]" <v-robeli@xxxxxxxxxxxxxxxxxxxx> wrote in message
<news:ALs74z1mHHA.5168@xxxxxxxxxxxxxxxxxxxxxxxxx
<> Hi Nick,
<>
<> Thanks for posting in our newsgroup.
<>
<> I am sorry for the delay response due to the weekend.
<>
<> From you description, I know that you scanned you system with
<> RootkitRevealer.exe, which shows that MSFax is creating a bad file in
it's
<> Queue directory, when you delete this file it comes backup again. If I am
<> off-base, please don't hesitate to let me know.
<>
<> First, when you delete the file, this comes back again, this seems to be
a
<> virus related issue. Our newsgroup doesn't provide technical support for
<> this kind of problem. You can contact Anti Virus software manufacture or
<> Security Company for more help, or you can wait for MVP's reply.
<>
<> I'd like to give you the following suggestions:
<>
<> 1. Empty out ALL your PC and Browser Temp files and Cache etc.
<>
<> 2. Immediately start doing the scans:
<>
<> For more information, please refer to:
<>
<> RootkitRevealer v1.71
<>
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx
<>
<> 3 .Scan you system with Anti Virus software which has the latest
<> signature.
<>
<> Windows Defender Home
<> http://www.microsoft.com/athome/security/spyware/software/default.mspx
<> 823166 Overview of Exchange Server 2003 and Antivirus Software
<> http://support.microsoft.com/?id=823166
<> Hope above information helps.
<> If you need further assistance, please don't hesitate to let me know.
<>
<> Best regards,
<>
<> Robert Li(MSFT)
<>
<> Microsoft CSS Online Newsgroup Support
<>
<> Get Secure! - www.microsoft.com/security
<>
<> =====================================================
<>
<> This newsgroup only focuses on SBS technical issues. If you have issues
<> regarding other Microsoft products, you'd better post in the
corresponding
<> newsgroups so that they can be resolved in an efficient and timely
manner.
<> You can locate the newsgroup here:
<> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
<>
<> When opening a new thread via the web interface, we recommend you check
<> the
<> "Notify me of replies" box to receive e-mail notifications when there are
<> any updates in your thread. When responding to posts via your newsreader,
<> please "Reply to Group" so that others may learn and benefit from your
<> issue.
<>
<> Microsoft engineers can only focus on one issue per thread. Although we
<> provide other information for your reference, we recommend you post
<> different incidents in different threads to keep the thread clean. In
<> doing
<> so, it will ensure your issues are resolved in a timely manner.
<>
<> For urgent issues, you may want to contact Microsoft CSS directly. Please
<> check http://support.microsoft.com for regional support phone numbers.
<>
<> Any input or comments in this thread are highly appreciated.
<>
<> =====================================================
<>
<> This posting is provided "AS IS" with no warranties, and confers no
<> rights.
<>
<> --------------------
<> <From: "Nick" <NoSpam@xxxxxxxxxxx>
<> <Subject: Why is MSFax creating temp files - Visible in Windows API, but
<> not in MFT or directory index.
<> <Date: Sun, 20 May 2007 13:13:46 +0100
<> <Lines: 14
<> <X-Priority: 3
<> <X-MSMail-Priority: Normal
<> <X-Newsreader: Microsoft Outlook Express 6.00.3790.2826
<> <X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
<> <X-RFC2646: Format=Flowed; Original
<> <Message-ID: <OflcShtmHHA.4848@xxxxxxxxxxxxxxxxxxxx>
<> <Newsgroups: microsoft.public.windows.server.sbs
<> <NNTP-Posting-Host: host81-154-103-121.range81-154.btcentralplus.com
<> 81.154.103.121
<> <Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP05.phx.gbl
<> <Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:38077
<> <X-Tomcat-NG: microsoft.public.windows.server.sbs
<> <
<> <Have checked out our server with RootkitRevealer.exe which shows that
<> MSFax
<> <is creating a bad file in it's Queue directory, when I delete this file
<> it
<> <simply comes back again, any idea why? Is this likely to be a proper
<> <Rootkit virus? By the way our Fax service has not worked for over six
<> <months.
<> <
<> <The RootkitRevealer log shows:
<> <C:\Documents and Settings\All Users\Application Data\Microsoft\Windows
<> <NT\MSFax\Queue\1C79ACFD68904.FRT 20/05/2007 12:13 8.53 KB Visible in
<> Windows
<> <API, but not in MFT or directory index.
<> <
<> <Nick
<> <
<> <
<> <
<>
<
<
<
.
- References:
- Why is MSFax creating temp files - Visible in Windows API, but not in MFT or directory index.
- From: Nick
- RE: Why is MSFax creating temp files - Visible in Windows API, but not in MFT or directory index.
- From: Robert Li [MSFT]
- Re: Why is MSFax creating temp files - Visible in Windows API, but not in MFT or directory index.
- From: Nick
- Why is MSFax creating temp files - Visible in Windows API, but not in MFT or directory index.
- Prev by Date: Re: Performance Logs and Alerts service not running
- Next by Date: Re: sharepoint user name change
- Previous by thread: Re: Why is MSFax creating temp files - Visible in Windows API, but not in MFT or directory index.
- Next by thread: DHCP on WAN side of ISA
- Index(es):
Relevant Pages
|
