OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Virus Detection in Exchange Server 4.0
From: Glenn Pearl (glennpBROOKE-STAFFING.COM)
Date: Tue Jun 13 2000 - 10:26:18 CDT

Hi George,

The D:\Exchsvr\imcdata\work folder is the working folder for the Internet
Mail Connector (IMC). The service puts files there while converting them
between internet format and Exchange format. The mail items are then
delivered, either out to the internet and the intended mail server, or
internally, to the intended mailbox. The filename NP474ACV is simply a
temporary name given to the mail item while its being worked on. Once it is
determined where it will go, the file is deleted. All this info in
available on the Microsoft site.

So, either Norton detected a KakWorm coming in to your network, or going out
of your network. If it was incoming, then its likely sitting in an Inbox
for one of your users. Scanning the systems will not reveal where it is,
since the regualar Norton scanner does not scan inside of Exchange
mailboxes. For that, you need NAV for Exchange.

If you have a current Norton support contract, I would suggest contacting
them for advice.

Hope this helps you at least understand how the Exchange mail system works. 

--
Glenn Pearl
Manager of Information Services
Brooke Staffing Companies, Inc.
New Orleans, LA
glennpbrooke-staffing.com
504-834-9772

> -----Original Message-----
> From:	George Hasapidis [SMTP:GHasapidisEIDETICS.COM]
> Sent:	Monday, June 12, 2000 1:17 PM
> To:	FOCUS-MSSECURITYFOCUS.COM
> Subject:	Virus Detection in Exchange Server 4.0
>
> I am running Norton Antivirus on an NT4(SP6a) server with Exchange
> Server 4.0.  Norton informed me that it has detected the WScript.KakWorm
> virus in
> "File Name: D:\Exchsrvr\imcdata\work\NP474ACV"
> However, when I manually scan the system, it comes up clean, and NT
> Explorer does not show any files, let alone one called NP474ACV, in
> D:\Exchsrvr\imcdata\work\.  I would appreciate any information on what
> that directory is, what that file might be, and, most importantly, what
> I need to do to get my server (and perhaps my LAN, all computers on
> which are also running Norton Antivirus) clean.
>
> Thanks in advance,
> George Hasapidis
> IS Manager