HOW TO: Remove a Virus-Infected Message from Mailboxes by Using the ExMerge.exe Tool

If a virus-infected e-mail message spreads to your users' mailboxes, your recovery might include removing the message from all of the mailboxes on your server. To do this, you can use the Exchange Mailbox Merge (ExMerge.exe) tool, which is included on the Exchange compact disc.

Administrators frequently use the ExMerge.exe tool to back up mailbox data or migrate it from one mailbox to another. ExMerge is designed to copy mailbox data into a personal folder file (.pst) that can then be imported to another mailbox. However, you can also use ExMerge to extract specific messages from mailbox stores to .pst files, and then delete the .pst files instead of importing them into new mailbox stores.

Remove a Virus-Infected Message from Mailboxes by Using the ExMerge.exe Tool

You can use Extract or Import (Two Step Procedure) in ExMerge to select the e-mail messages by subject line or attachment name, export the e-mail messages to .pst files, and then remove the e-mail messages from the source mailboxes. After you use ExMerge, you can manually delete the .pst files.

To extract virus-infected e-mail messages from mailbox stores:

1. Set up ExMerge by following the instructions in the documentation that is included with the ExMerge.exe tool. Start the ExMerge wizard.
2. On the Procedure Selection page, click Extract or Import (Two Step Procedure) , and then click Next.
3. On the Two Step Procedure page, click Step 1, and then click Next.
4. On the Source Server page, type the name of the server under Microsoft Exchange Server Name, and then click Options.
5. On the Source Server page, click Options.
6. On the Data Selection Criteria page, click User messages and folders on the Data tab.
7. On the Import Procedure tab, click Archive data to target store.
   
   This option copies the e-mail messages to .pst files, and then deletes the e-mail messages from the source mailboxes.
8. When you receive the warning message, click Yes. The Source Server page reappears.
9. On the Source Server page, click Options.
10. On the Message Details tab, do one of the following:
    • Type the subject of the e-mail message, and then click Add. Select the search method that you want to use in the Subject string compare criteria drop-down list, and then click OK.
    • Type the name of the attachment, and then click Add. Select the search method that you want to use in the Subject string compare criteria drop-down list, and then click OK.
11. On the Source Server page, click Next.
12. On the Mailbox Selection page, select one or more mailboxes from which to extract the e-mail message, and then click Next.
13. In the Default locale drop-down list, select the appropriate language, and then click Next.
14. On the Target Directory page, if you want to change the location of the .pst files, click Change Folder. Otherwise, click Next.
15. On the Save Settings page, click Next to start the extraction process.
16. After the extraction process is complete, open a few mailboxes to make sure that the message is removed.
    
    NOTE: As a safety precaution, ExMerge does not delete messages from the System Attendant mailbox. You must manually delete these messages.
17. After you determine that the message is removed from all mailboxes, delete the .pst files in the C:\Exmergedata folder.

For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

The ExMerge.exe tool and documentation are available on the Exchange compact disc in the following folder: Support\Utils\I386\Exmerge.