Cleaning the Exchange Environment

  • Article

 

Review and understand the recommendations in this section before a virus attack occurs. If an outbreak occurs, implement these recommendations as appropriate, according to the level of infection within your system.

Important

Although this section discusses shutting off mail flow, shutting off mail flow every time there is an e-mail transmitted virus is not recommended, especially if such an outbreak occurs during peak mail usage, and the level of disruption caused by the virus does not warrant such a severe response. However, there may be virus outbreaks that are so disruptive that they may warrant shutting off mail flow. This section is written for such an outbreak.

The approach given here assumes a widespread infection like that found in a "Melissa" or "ILOVEYOU" type of outbreak. Your objectives in responding to such an outbreak are to shut off mail flow to and from the Internet, clean and isolate servers, run antivirus software updates, and then reestablish mail flow. To achieve these objectives, follow these steps:

  1. Stop Internet mail flow on gateway servers.

    1. Clean mail queues.

    2. Disinfect servers.

  2. Stop internal mail flow.

  3. Isolate and clean infected mailbox servers.

    1. Disable user access to mailboxes.

    2. Clean SMTP and MTA queues.

    3. Clean mailboxes.

    4. Disinfect servers.

  4. Apply antivirus software updates.

    1. Apply the most recent antivirus definitions to all antivirus products (for example, at file-level, AVAPI, gateways, and mailbox servers).

    2. Run antivirus tools to verify that the computers are clean.

  5. Clean user workstations and update antivirus software definitions.

  6. Reestablish user access to mailboxes.

  7. Reestablish Internet mail flow connectivity.

The following sections describe these steps in more detail.