Exchange Server Infected

[Keyboard Cowboy]

Here the clients set up....

Cleints Server :- WINDOWS SBS 2000 SUITE
Running Exchange 2000
Running SQL 2000
AntiVirus :- Symantec Corporate.

The problem with this server is that the exchange has been infected down to the point that the MAILBOX STORE and THE PUBLIC FOLDER STORE will not mount.
When we retry to remount the services, we get the error message :-

An interal processing error has occured. Try restarting the Exchange System Magager or Microsoft Exchange Information Store Service or both,
ID NO C1041724
Exchange System Manger

Other exchange services are still running.
SQL is still running.

Since then, we have installed EXCHANGE SERVICE PACK 3 hoping that it will fix the problem. No luck

And now it coming down to the fact that we have W32.sober.0@mm!.enc and 32.netsky.p@mm viruses on this system.

Now we have ran Symantec Removal Tool, and it does not remove the virus.
We ran McAffee Stinger (latest verion), it detect it, but again does not remove it.
We have actually gone in and deleted the invidual files that are infrected, but the virus then multiplies.

And the other problem is that I need to do this remotely as this server is about 300km away. I would like to avoid driving their if I have too.

Need suggestions on removing this virus once and for all.

[Keyboard Cowboy]

Now I have all ready suggested about isolating the server by disconnecting the the workstations from it. And from there carrying out a virus scans and clean up on the other work stations.

Then reconnecting the workstation after we know they are clean and the server is clean. It's really coming down to cleaning up the server.

[Static_11]

Multiplying virus.... sticky situatuion..

[Keyboard Cowboy]

Originally posted by Static_11
Multiplying virus.... sticky situatuion..

Pretty much.

We really don't want to blow away the client's emails if we don't have to.