Using Exmerge as a Virus Cleanup Tool

In Exchange 5.5 or earlier, use the Exchange Service account to log on to the Exchange server.

Create a folder called Exmerge on the server, then extract the Exmerge files (i.e., exmerge.exe, exmerge.ini, and mfc42.dll) to that folder.

If you disabled Exchange’s Information Store, enable it again.

Run exmerge.exe, then click Next to start the Microsoft Exchange Mailbox Merge Wizard.

In the wizard’s first dialog box, select the Two step merge option.

In the next dialog box, select the Step 1: Copy data to Personal Folders option, then click Next.

Type the name of the Exchange server in the Microsoft Exchange Server Name text box. Click Options.

In the Data Selection Criteria dialog box, which Figure A shows, click the Data tab, then select the check box beside the content that you want to delete (e.g., User messages and folders). Click Apply.

Click the Import Procedure tab, then select the Archive data to target store option. This step is important because it moves the infected messages to a destination .pst file and deletes the original message from the source mailboxes. A message will warn you about the pending operation; click Yes. Click Apply.

Click the Message Details tab. In the Enter new message subject and Enter new attachment name text boxes, which Figure B shows, type some unique identifying information that will target only infected messages. Click Add, click Apply, then click OK.

Click the Dates tab, then type a specific range of dates. If the attack just occurred, I usually choose just one day.

Click Select All, then click Next to run Exmerge. My scans usually take between 5 minutes and 60 minutes per hundred users.

When Exmerge is finished, check a previously infected Outlook client to make sure that all infected email messages are gone. Delete the Exmerge-created .pst files only after you’re sure that you didn’t accidentally delete any uninfected email messages.