Forefront High CPU utilization or Quarantines with Virus name: ‘Exceeded Internet Timeout’

Today few of my colleagues started to receive emails from Exchange 2007 Server as follows:

FILE QUARANTINED

The original contents of this file have been replaced with this message because of its characteristics.
File name: ‘Body of Message’
Virus name: ‘Exceeded Internet Timeout’

Since we have an Edge Transport Server that has forefront server security installed, I tried to login to the server to check the logs. The CPU is at its peak and the server is inaccessible. After a long wait, I finally managed to get in there, but I am still unable to open Services or Event Log.

I checked the Hub Transport server and all the outbound emails are in the queue. The Edge Transport server is not processing inbound or outbound emails. I did a hard reset and still 100% CPU utilization.

When I managed to get the Services console open, I stopped the following services in this order.

1. Microsoft Exchange Transport
2. FSCController

Then the server started to behave normally. On the Application Event Log, the following entries appear.

• The execution time of agent ‘FSE Routing Agent’ exceeded 300000 (milliseconds) while handling event ‘OnSubmittedMessage’. This is an unusual amount of time for an agent to process a single event. However, Transport will continue processing this message.
  
• Transport scan exceeded the allowed scan time limit.
  
• At least one of the engines that is in use is slated to be discontinued. You need to take immediate action to prevent a reduction in malware/spam protection. Details can be found at: http://go.microsoft.com/fwlink/?LinkId=165685.

After a few minutes of search on Bing (http://technet.microsoft.com/en-us/forefront/serversecurity/dd940095.aspx), I found out that Microsoft is revising its engine mix on Dec. 1, 2009 for the Forefront and Antigen products.

The AhnLab, CA and Sophos engines will be retired on Dec. 1, 2009.  As of this date, customers will not receive any updates for these retired engines. Any customers running the AhnLab, CA or Sophos engines must DISABLE these engines before Dec. 1, 2009 and select from the new set of five engines – Authentium, Kaspersky, Microsoft, Norman and VirusBuster.

So I had to disable the Forefront Security for Exchange Server.

From a command prompt, navigate to the Forefront Security for Exchange Server installation directory (C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server). Disable Forefront Security dependencies by typing:

FSCUtility /disable

To confirm that the Forefront Security dependencies have been removed, type:

FSCUtility /status

Restart the Exchange services (Microsoft Exchange Transport). Now the emails should go without being scanned.

Do the changes to the engines in Forefront Administrator console. Make sure you do it to the Transport Scan Job as well as Default.

If you think that the scan engines are corrupted, you can delete the folders at “C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server\Data\Engines\x86″ So the next time the Forefront updates according to the schedule, it will get the latest engine and recreate the folders.

After you disable the retired engines in the console, you can enable the Forefront for exchange again.

FSCUtility /enable

Hopefully, the CPU utilization will be normal and the emails are checked for viruses.

How to export Exchange 2007 mailbox to a PST file

What is a PST file?

Taken from Wikipedia: a Personal Storage Table (.pst) is a file used to store local copies of messages, calendar events, and other items within Microsoft software such as Microsoft Exchange Client, Windows Messaging, and Microsoft Outlook.

If an employee leaves the company and you want to export the mailbox to a PST file and store it as a backup, it is very easy to do this in Exchange 2007.

Pre-requisites:

• Remote computer that has Outlook 2007 installed. This is a must. Don’t install Outlook on the Exchange server itself
• Exchange Management Shell installed from Exchange 2007 media
• Windows Power Shell installed

Login to the remote computer with your domain credentials. Note that the domain credentials that you use to login must have FULLACCESS permission on the mailbox you are exporting. If not, this will fail.

If you want to give yourself FullAccess permission on a mailbox, you can run the following script from either PowerGUI or Exchange Management Shell. Change the script according to your requirements.

Add-MailboxPermission -Identity “John Crawford” -User “Contoso\Administrator” -AccessRights FullAccess

After the permission has been added, open up the Exchange Management Shell (EWS) on the remote computer and run this script.

Export-Mailbox -Identity john.crawford@sujeeth.net -PSTFolderPath C:\PSTBackup\John_Crawford.pst

You will get a confirmation prompt:

After pressing Y, the exporting starts

You can remove the FullAccess permission that you added earlier as follows:

Remove-MailboxPermission -Identity “John Crawford” -User “Contoso\Administrator” -AccessRights FullAccess

You can also set filters and actions to be performed while exporting. Some examples as follows:

Get-User john | Export-Mailbox -SenderKeywords info@sujeeth.net -DeleteContent

Get-User john | Export-Mailbox -TargetMailbox sujeeth -TargetFolder reports -SubjectKeywords “laser eye” -DeleteContent

Get-User john | Export-Mailbox -PSTFolderPath C:\PST_Backup\john_crawford.pst -SubjectKeywords “laser eye” -DeleteContent

Get-User john | Export-Mailbox -TargetMailbox sujeeth -TargetFolder MessageCleanup -SenderKeywords info@sujeeth.net -DeleteContent -MaxThreads 10

Use Remote SMTP server for MOSS Incoming e-mail settings

If Microsoft Office Sharepoint Server is installed on a server that doesn’t have a local SMTP server or you could not install SMTP service becuase Exchange 2007 runs on the same server, you could use the remote SMTP server as follows:

First find the account that Windows SharePoint Services Timer runs under.

Then login to the remote SMTP server (a local server that’s part of the same domain as your MOSS server)

I assume you have already installed SMTP service on the remote computer. Browse to the default SMTP mail directory (usually C:\Inetpub\mailroot) and setup a share for the mailroot folder called MossMailRoot

Add the service account (uk\sharepoint) for the mailroot folder with full permissions.

Now open Central Administration à Operations page on your MOSS server

Open Incoming e-mail settings and set E-mail Server Display address as sharepoint.local and the E-mail drop folder as \\<servername>\<sharename>\Drop

You need to update your DNS server records to point sharepoint.local to the remote SMTP server

On the Remote server, Open IIS console and drill down to Default SMTP Virtual Server. Add new Alias domain for sharepoint.local

The server setup is complete. Now browse to your Intranet page and setup Incoming E-Mail Settings for one of the libraries.

Now When the users send an email from their Outlook client to announcements@sharepoint.local the email will be received by your Exchange. Assuming you have Exchange 2007, you need to configure a Send Connector so that Exchange knows where to forward that email.

The Send Connector will have the following configuration

Once this send connector is configured, Exchange 2007 will forward all emails with sharepoint.local domain to the remote SMTP server. The email will be stored in the Drop folder.

The Windows SharePoint Services Timer service monitors this folder at regular intervals as the network path is given in its configuration. If it finds any emails, it will check for the recipient email address and routes the email to appropriate Sharepoint library. After that it deletes the email message from the Drop folder. That’s why you need to give modify permissions for the service account on the mailroot folder.