EDB to PST Conversion Modes

In my previous article "why do you need EDB to PST converter software", I have discussed the need of EDB to PST conversion tools. There are lots of professional EDB to PST converter tools for converting EDB file to PST file.
In this article "EDB to PST Conversion Modes", I want to share the modes of EDB to PST conversion that are supported by these tools. However, these features may vary from tool to tool.

Generally, EDB to PST converter tools supports two modes of conversion:

• On-Line EDB to PST conversion

• Off-Line EDB to PST conversion

On-Line EDB to PST conversion:
If you are working over exchange and you need to convert your EDB files to PST then, you can use this conversion mode without taking your exchange offline. Your work will go side by side and the conversion process will not disrupt the exchange services thus, this feature makes the conversion process more efficient and time saving.

In the on-line conversion mode, some EDB to PST tools also offer you the feature to convert On-Line EDB to EML or MSG Files. Converting the EDB files to EML (Email) or MSG (message) files, makes the data easier to access. This makes your files easily importable to MS Outlook and Outlook Express, You can easily view the content within MSG files by importing in MS Outlook and EML files by importing into Outlook Express. Thus, this feature offers more flexibility for EDB to other file-format (PST, EML or MSG) conversion. You can choose the best option according to your ease and requirement.

Off-Line EDB to PST conversion:
This mode of EDB to PST conversion is used when there is a scheduled or planned shutdown of Exchange server. This mode offers a faster conversion process as compared to the online mode. This mode is best applicable when taking your exchange offline doesn’t hinder the communication within the organization or any other task to be performed. So, Take your Exchange offline and enjoy faster EDB to PST conversion process than the online conversion mode.
However, there are other cases too when this mode is applicable.

Lets take a scenario, suppose you are working while your exchange is offline and you got any mailbox deleted accidentally then, what can be done in that situation…??
You can easily restore the Accidentally Deleted Off-Line EDB Mailboxes by using the Off-Line EDB to PST conversion mode offered by the EDB to PST converter tools. But one thing need to be kept in mind that the deleted Mailbox should be within 'Mailbox Retention Period' Otherwise, these tools are not going to help you to recover  the Accidentally Deleted Off-Line EDB Mailboxes.

If you ever need to convert your EDB files to PST file then, you have a lot of choices available in market. These tools offer a multitude of options that makes the EDB to PST conversion process more flexible and easier to handle. The only thing you need to do is select the best one that contains the desired set of features and then, accomplish the EDB to PST conversion process in few clicks.

Read more

Why Do You Need EDB to PST Converter Software ?

EDB files contains the exchange server  database and all the information about user mailboxes, these EDB files are stored in b-tree structure, which includes a top level node and many child nodes. The main EDB files used for the Exchange information store are Priv1.edb and Pub1.edb. The EDB file acts as a pointer to the user’s MS Outlook profile. It is also known as repository of all sent/received emails as well as information related to these emails.

All the EDB files are contained within the folder MDBdata (exchsrvr\mdbdata), it contains all EDB files such as: Priv1.edb file, Pub1.edb file, STM file and Log file etc. 

What’s the Need of EDB to PST Converter Software?

Let’s read about some common situations in which you need EDB to PST Converter Software:

• To Convert Exchange MDBdata into PST Files: Whenever, there is a downtime with Exchange server, you can convert Exchange MDBdata into PST files and then, these PST files can be used in Microsoft Outlook.
• To Backup EDB files: EDB file corruption may lead to severe data loss so, to prevent such situation, you need to backup your EDB files at regular intervals so that you can restore your data if EDB gets corrupted.

There is also a second option for taking backup of your EDB data. You can convert your EDB data to PST file and store them separately at any desired location.

• To Extract multiple PST files from single EDB file: EDB to PST conversion enables the users to extract data from both priv.edb as well as pub.edb files, and also allows conversion from EDB to PST files with absolute perfection.
• For Defunct Exchange Server : When Exchange server goes to defunct or non-functioning state then communication tasks within the organization or any other distributed exchange server environment could not be handled properly.                                                                        Reasons for non-functioning state of Exchange server:
• Unsystematic installation of Exchange Server from organization.
• Removal of users from Exchange Server without deactivating user info.
• Exchange Server unable to function properly.
• Up gradation of Exchange Server to new version from the prior one.

EDB files cannot be opened and the data stored in EDB files becomes inaccessible. In such situation you can take your EDB files and can convert them into PST files, that PST file can be opened easily within MS Outlook.

• For mounting of Exchange EDB files to Outlook: If user wants to mount the Exchange Database to Outlook then, user needs to convert EDB files into PST files.
• For Offline EDB to PST Conversion: If your Exchange server goes down or damaged then, you cannot access the Exchange database. In such situation you need offline EDB to PST Conversion. You can use EDB to PST converter tools for offline EDB to PST conversion.  
• Server administrator needs EDB to PST converter tools, if one of his clients lost his PST file. Now, the user will not be able to access his mailbox. By using EDB to PST converter tools server administrator can convert the Exchange database to PST files and can export the specific client mailbox to a new PST file using the command prompt environment provided by Exchange server. This newly created PST file can be used by the client to access his mailbox. 
• To Restore Accidentally Deleted Off-Line EDB Mailboxes: If any mailbox got deleted accidentally while your Exchange is off-line then you can recover the deleted mailbox by using offline EDB to PST conversion. 

Above discussed are some situations in which a user needs EDB to PST converter tools. These tools help user to extract all his mail components without altering original format, properties and metadata information of the mail components. These tools let you convert on-line as well as off-line EDB files to equivalent PST files.

Read more

Pros and Cons of MS Outlook

In my previous post, I have discussed about the new features added in the Microsoft outlook 2013 beta version.MS outlook is an integrated part of Microsoft office suite. Current version of Microsoft office suite contains various revised features and also, newly added features but still something is lacking behind. In spite of a lot newly added features, there is still a lot more to  be added in the forthcoming years.MS outlook Email Client offers various features for organizing Emails, solid spam and phishing filters as well as  social integration but though, its cons are legging side by side. Let’s have a look at the pros and cons of using the current version of Microsoft outlook.

Here is the List of some useful features of MS Outlook:

• Strong and Effective filters: These filters help you for spam filtering and blocking phishing attempts and thus, let you enjoy a safe Email Exchange process.
• Easy Email organization features: Its features such as Snappy, conversations and mail grouping, flexible search, smart folders, virtual folders make the task of email organization easier.         You can set up "Quick Steps" buttons in the toolbar; it will let you access filing mail, replies, new messages to oft-mailed recipients flagging and more in one-click.
• Effective integration features: You can now, enjoy powerful integration features for email messages, to-do lists, scheduling and social networking updates well. You can now easily linkup with your favorite social networking services without the use of social connector.
• Multiple accounts: It let you manage multiple accounts such as, POP, IMAP, Exchange, MSN and Hotmail accounts.
• Easy Message organization: MS Outlook provides filers that let you easily organize, thread, and label Email messages. You can easily find messages with the help of "Search Folders”, which automatically contain all items matching certain criteria.
• S/MIME email encryption and IRM access control: S/MIME (Secure/Multipurpose Internet Mail Extensions) and IRM (Information Rights Management) access control lets you enjoy secure Email exchange process, as it display all the mails in super-secure plain text and also supports HTML message viewer that makes the more secure.
• Better secure download: MS outlook provides displays all the mails in plain text and doesn't download remote images and thus, provides better privacy.
• Other Newly added features: New version of MS outlook contains a lot of  new features which makes it more consistent and easier to use, these new features include Metro UI, Hotmail and social networking integration, Peeks, Inline replies, Weather tool, Touch-oriented mode, Improved Calendar module, Renamed Contacts module. If you want to read in details about these features, see my previous article to know what’s new in MS outlook 2013 beta? 

Cons of using MS Outlook:

• Multitude of options can make its use, a bit confusing for users and there is a lot of setup for custom Outlook views that might be cucumber some for users. Some of the items in menus have been moved to other new menus which can be confusing for old Outlook users.
• Current versions of MS Outlook lack useful message templates, and its RSS feed reader flexibility that needs to be added in the future version.
•  There is no way to apply categories to messages in IMAP accounts in MS Outlook. This is also one of the lacking points in current versions of Outlook.
• Outlook items can be sorted by clicking a column title and by Clicking toggles between ascending and descending order. There is no proper way to manage sort order for a custom view, we have limited sorting options such as for
•  Most views: Sort by Priority, then Start Date 
• Recent view: Sort by Modified Date only.
• Auto prioritization need to be improved in the coming outlook versions. If we compare outlook with Trog Bar then, we can say that it comes close but still, Trog Bar is far much better as it auto-prioritize more nicely than Outlook.
• Auto-suggest tasks need to be improved in the next versions: The current version of outlook can’t auto-suggest tasks based on the users Strategic Calendar. 
• Message templates could be more flexible, though, and its smart folders could learn from example.

MS outlook is a popular email client, Pros and cons are walking side by side with its use. Its one among the popular Email clients, with the set of numerous features that makes it more interactive and easy to use .But still many extensions need to be added for expanding the feature set of Microsoft Outlook, lets hope for a better move in the coming versions.

Read more

Do you know? What’s New in Microsoft Outlook 2013 Beta?

MS Outlook 2013 Beta is now available with a slightly revised user experience as compared to previous versions. You can now enjoy its unification with other Microsoft products including native Hotmail and social networking integration.

Microsoft has not only redesigned the general look and feel of the Outlook email client but also added new features to the product:

Let’s see what’s new?

• Metro UI: It makes easier for users to navigate to their documents and pictures. The new outlook has been made more touch friendly. This provides a much better interface within outlook. Its simple than the previous version and make outlook UI less cluttered. 

• Hotmail and social networking integration: With Outlook 2013 Beta previous Outlook Connector and Social Connector add-on are no more required. It offers native social networking integration of Hotmail as well as other social sites such as Facebook and LinkedIn. You can easily linkup with your favorite social networking services.

• Peeks: It is an application-centric QuickLook i.e. Offers Quick Look to the information about Outlook items without actually opening them and also you don’t need to leave the current window. Now, you can see a pop-up preview of the modules (People, Mail, Calendar and Tasks) just by simply mouser over one of them. These modules links have moved from the sidebar to the bottom of the screen.

While emailing a particular contact, People pane will appear in the bottom of the new message window as it appeared in case of social connector in the previous versions. You can view some information about the contact that appears right in this page. If you want to get more information about the contact, you can simply expand it to view more information about the contact. This information will include the details gathered from the he integrated contacts list, email service and various other social networking services configured in your outlook client. 

• Inline replies: In previous versions of Outlook, a new window would pop-up when you replied to an email message. Now, replies can be made inline by default in the area normally reserved for the reading pane instead of opening a new window. And, this is now consistent with (OWA) Outlook Web Application.

• Weather tool: Outlook 2013 Beta includes a weather tool bar in the Calendar module.

• Touch-oriented mode: User can turn on/off the touch mode feature. You can now easily navigate Outlook, You can easily handle the menu items as you can enlarge or scale down the size with your finger instead of a mouse.

• Improved Calendar module: Improved Calendar module offers support for various calendar types, such as the CalDAV standard. 

• Renamed Contacts module: Contacts module has been renamed to the more consistent People.

The entire MS office suite 2012 or Office 15 has been made more consistent with the added new features. The user can now enjoy world class messaging, contacts, calendaring and social collaboration for both enterprise and cloud. These improved outlook features are just a visionary peak. There is a lot more that Microsoft is going to add in years to come.

Read more

How to Fix ‘Exchange Server Error Code 528, 550’?

MS Exchange Server stores all its data in form of storage groups. These storage groups consist of database files, transaction logs, system files (temp.edb file, E##.chk file).The exchange mailbox store stores priv1.edb and priv1.stm files. What will happen if the MS Exchange Server database gets corrupted…?
MS Exchange Server database corruption may lead to inaccessibility of mailbox, loss of all the Database and public folders and may also lead to several kinds of errors.
In order to get rid of all these troublesome situations, you need to repair EDB files. 

How would you know that EDB file got corrupted...?
You can do a time to time evaluation by checking functioning of your Exchange Server Database.

• Are you getting some problem in accessing EDB file form Exchange Server Database?
• Are you getting any Exchange Server Database error code while synchronizing or shutting down your system

If you are getting these problems then, it is sure that your Exchange database has got corrupted.

You might me thinking that you can restore from the backup server and then, easily restart Exchange Server services after restoring from a backup. Probably, everything should work fine then. Well, you can do it, but it may give some errors and the information service might fail to start.

• You can face any of the below problem:
• When you attempt to move the sys and log files, and leave them empty, you get “Error -528” error message.
• You cannot start the Exchange Server services. You get “Error -550” error message.
• Exchange Server database is marked as suspect and dirty shutdown.
• Database does not come up after deletion of log files, which are “not committed."

Causes for Exchange Server Error Code 528, 550:
Error Code 528: It corresponds to JET_errMissingLogFile.When you attempt to move the sys and log files (Edb.log and Edb.chk files) of MS Exchange Server database, and those are missing from the Exchsrvr\Mdbdata, you get “Error -528”.
Error Code 550: It occurs due to inconsistency in backup. It leads to failure of successful restore. It may happen when the backup software and Exchange Server was on-line, and you are running eseutil.exe or trying to start the Microsoft Exchange Directory service.

Let’s move ahead, to know the ways to deal with the above described error codes.
The remedies for the problem are:

• soft database recovery by using Eseutil /r command
• hard repair by using Eseutil /p command
• Third-party Exchange Recovery Tool.

These tools provide you an easy to use interface that helps in repairing the damaged Exchange Server database files (.EDB files). The Exchange Server recovery software recovers mailboxes into usable PST file. You can import the PST files to your MS Outlook application and regain access to inaccessible mailboxes.   

Read more

What is Exchange System Attendant?

I've installed an Exchange Server 2007 on a Domain Controller.
But it skewed me when I tried to restart the Exchange services, as I got the error message:
“Could not start the Microsoft Exchange System Attendant service on Local Computer”.

As, I am a novice user, I was troubled. I didn’t know why this happened and what to do? With a little searching online, I gathered some information about functioning of the Microsoft Exchange System Attendant. It would be great to share that here.

What is Exchange System Attendant?
It is a collection of subcomponents that work together to perform Exchange-related services.

The main functions of Exchange System Attendant are:

• To regulate internal Exchange Server functions 
• To Mount the  databases 
• To handle the proxy Active Directory requests
• To Maintain the  Exchange information store 
•  To monitor, maintain, and directory lookup services for Exchange Server.
• To Provide Exchange Active Directory Access 
• To Provide Directory Service Lookup for older Outlook clients 
• To Monitor server resources 
• To Manage mailboxes 
• To update metabase i.e. Replicating settings from Active Directory to the IIS(Internet Information server/Internet Information Services (IIS) metabase 
• To Verify computer account configuration

Here, I would like to introduce a general term associated with Exchange System Attendant and that is “System Attendant mailbox” What is it?
When the System Attendant is created on a server then, the System Attendant mailbox is created automatically or in other words we can say that, it is associated with the first mailbox store created on a server.

”SpecialPrivateFolderForFreeBusyStorage” is a special folder within the Exchange System Attendant.
This folder is essential for:

• MSExchangeFBPublish process when OWA (Outlook Web Access) push Free/Busy information up to the store.
• Mailbox moves. 
• Legacy link monitoring service to send and receive the messages 

A short introduction to main parts of the System Attendant mailbox: 
A mailbox object and a directory object:
The Mailbox object: It is stored within the first Mailbox store i.e. the “Mailbox Store (servername)” store.

The directory object: It is located with in the configuration container.
The location looks like:
CN=Microsoft System Attendant,CN=<servername>,CN=Servers,CN=<sitename>,CN=Administrative Groups,CN=<orgname>,CN=,CN=Services,CN=Configuration,CN=<domain> ).
The directory object is required for hosting the entire directory attributes associated with the system attendant.

It’s very important to have System Attendant mailbox configured properly and available on your system. If it’s not configured properly then, it can hamper proper functioning of your Exchange server. It may lead to problems while updating OWA-generated Free/Busy information. It can also cause the mailbox moves fail. Hopefully, this post will help you to get awareness about the Exchange System Attendant and its importance in Exchange server. I wish to come up with the next post soon, there I would like to discuss about Errors and the remedies associated with Exchange System Attendant.

Read more

Troubleshooting for Error message 0x80040109 in MS Outlook

Yesterday, when I was trying to send a mail from my Outlook account, all of sudden I received an error message says:
 “0x80040109 – The Operation cannot be performed because the message has been changed”.

I tried to find a solution to fix the problem, I Uninstalled my antivirus and then reinstalled it without e-mail scanning feature. And Yeah! It worked. After that everything was working fine.

If you are facing the same problem then reading this article may help you.

Let’s have a brief introduction with the error: 
Error Message - 
(0x80040109): 'The operation cannot be performed because the message has been changed.'

This error occurs when third party software (such as desktop search or backup software) tries to change the email message in between the sending process. The Antivirus software or firewall installed on your system can also lead this error.
This error may cause problem while sending Emails. It can also cause calendar or contacts duplicates because due to this error the MS outlook couldn’t save the record of previously migrated messages. When you re-start the migration process then 'Only New Data' is checked and the previously migrated messages will be migrated again.

Solution:
Before trying to resolve this problem you must know that which application is causing the problem.
To determine which add-in is causing this issue you need to Start Outlook in safe mode and verify the result:
Follow the below steps to Start Outlook in safe mode:

• Hold Windows key + R.
• Type the following command “Outlook  /safe” in the Open box
• Press Enter.

Now, disable each add-ins one by one to determine the problem causing add-in.

a) Click >File > Options >Add-ins >Go button besides Manage: Com-in Add.
b) Clear the checkbox if add-ins are listed there
c) Close the MS Outlook application and restart it.
d) Disable each add-in one at a time, restart the Outlook, and repeat the above procedure.
If the issue reappears again, it will help you to determine error causing add-in.

So, here is the solution

• If your antivirus or firewall is causing this error then, disable email scanning and then restart Outlook.
• If the issue is due to any other add-in, then uninstall and re-install the application. You can also rectify your problem by checking the program support to rectify the conflict.

 I hope this article is going to help you to fix outlook PST file. To get more updates keep reading my blog. Your valuable feedback & suggestions are welcome.

Read more

Fix it: "An unknown error has occurred??"

Have you ever faced the error message…?? ”An unknown error has occurred” while using MS Outlook

It can occur on any of the outlook versions 2002, 2003, 2007, or 2010 on Windows XP, Vista or 7. This error occurs due to PST file corruption. This makes the stored data and other functions inaccessible to the Outlook user. You may get trouble while reading, sending, receiving, or deleting an email message in MS Outlook.

You can get one of the following error messages:
Error message 1
An unknown error has occurred. 0X80040119

Error message 2
An unknown error has occurred. 0X80040600

While deleting email messages, following error message can appear:
“Messaging interface has caused an unknown error”.

Cause for the above error messages: 
These error messages "An unknown error has occurred" indicates *.pst file corruption.

• Sometimes when you install updates on your system then, improper or incompatible updates may lead to PST file corruption and that may lead the error message: “An unknown error has occurred. 0X80040119”.

Some common reasons for the error message” An unknown error has occurred. 0X80040600” are:

• Unauthentic mail server client 
• Any change in email account 
• Active anti-spam or anti-virus scan

Solution to fix the above error messages:
You can use Inbox Repair Tool to fix this issue. It is a free utility provided by Microsoft that comes along with MS outlook.

Its Default location is: 
%ProgramFiles%\Microsoft Office\Office12\
Location of Inbox Repair Tool (ScanPst.exe) varies from one Outlook version to other. If you are not able to locate the scanpst.exe, you can download it from the Microsoft official website.

How to Use Inbox Repair Tool to repair corrupted PST file?
First, you need to locate PST file:
   1. Go to the Control Panel window in Windows Operating system.
   2. Choose “User Accounts”.
   3. Click the “Mail icon”.
   4. Choose the Data Files button in mail setup –Outlook dialog box.
   5. Select the Personal Folder file and choose Settings button.
   6. Copy the location of File Name and paste it onto Windows explorer

After completing the above steps, you have found the exact location of your damaged PST file.

Now, follow the below steps to locate Inbox Repair Tool:
 1. Open Windows Explorer.
 2. Now, according to the version type, you can type below given path addresses:

•  For MS Outlook 2002: %ProgramFiles%\Common Files\System\Mapi\1033\
•  For MS Outlook 2003: %ProgramFiles%\Common Files\System\MSMAPI\1033\
•  For MS Outlook 2007: %ProgramFiles%\Microsoft Office\Office12\
•  For MS Outlook 2010: %ProgramFiles%\ Microsoft Office\Office14\

Use Inbox Repair Tool to repair corrupted PST file:
   1. Once the path is specified choose Go button. You are navigated to the folder with scanpst.exe and allow PST repairing.
   2. Locate the tool and double click to open it.
   3. You can now browse corrupt PST file and choose Start button
   4. Follow the instructions that prompt after clicking the Start button
After completion of the above steps you will get the Outlook PST file repaired.

However, Sometimes Inbox repair tool unable to fix this error.
This happens due to the Limitations of Inbox repair tool

• It cannot repair PST files that have size above 2GB.
• It cannot repair highly damaged PST files.
• It repairs PST file in ANSI format only.

In such scenario you will require other PST repair tools. These tools easily repair the corrupted PST with the use of powerful algorithms. These tools provide you an easy to use interface that helps you fix this error in just few clicks.

Read more

Towards the Intel Core i7 Extreme Edition

Core i7 is a successor to the Intel Core 2 brand. Intel Core i7 includes several families of desktop and laptop processors. This family includes 64-bit x86-64 processors that use the Nehalem, Westmere, Sandy Bridge and Ivy Bridge micro architectures. Intel Core has developed a series of processors; among them are the latest Intel Core i7, Intel Core i5, and Intel Core i3, and the older Intel Core 2 Solo, Intel Core 2 Duo, Intel Core 2 Quad, and Intel Core 2 Extreme lines.

The second generation of Core i7 processors based on the “Sandy Bridge” core was released in January 2011 and later on they were updated in April 2012 with "Ivy Bridge" micro architecture.
Bloomfield is the code name given to existing Core i7 900-series processors. Core i7 900-series includes 3.33-GHz Core i7 975, 3.06-GHz Core i7 950, and 2.66-GHz Core i7-920 processors. The 2.93-GHz Core i7 870 and 2.8-GHz Core i7 860 processors are code named as "Lynnfield". The brand-new, 2.66-GHz Core i5 750 CPU is a Lynnfield chip.

The Intel Core i7 Processor is known as Nehalem .Nehalem brings some new improvements in the Intel approach to CPU, system scaling and DRAM memory management.

Let's walk through the big architectural changes:

• Number of pins in the new Core i7 processor is 1366. 
• Larger size of the processor, socket and heat sink mounting brackets. This new processor socket LGA1366 is quite a bit bigger than LGA775. 
• The die size of Core i7 processors is 263 mm2 
• The transistor count is 731 Million that are built up-on a 45nm fabrication processes.
• All Nehalem chips have 64KB of L1 cache and 256KB of L2 cache. Those are supplemented by a large pool of shared L3 cache.
• Quick Path: This includes an integrated triple channel DDR3 memory controller that allows getting the product heaps of memory bandwidth.
• Hyper-Threading: It is a Pentium 4 era technology. Quad-core Core i7's processors use the concept of Hyper-Threading that lets the operating system see eight virtual cores to be used.
• New SSE4.2 Instructions 
• Improved Lock Support 
• Additional Caching Hierarchy 
• Deeper Buffers 
• Improved Loop Streaming 
• Simultaneous Multi-Threading 
• Faster Virtualization 
• Better Branch Prediction

Three more Core i7 processors are going to be released by Intel in the following years.  All these processors will have a TDP (Thermal design power) of 130W and an on-die shared L3 cache of 8MB.

• Core i7 965 Extreme Edition - 3.2GHz with 8MB Shared L3 cache and a 1x6.4GT/s QuickPath interconnect 
• Core i7 940 - 2.93GHz with 8MB Shared L3 cache and a 1x4.8GT/s QuickPath interconnect 
• Core i7 920 - 2.66GHz with 8MB Shared L3 cache and a 1x4.8GT/s QuickPath interconnect 

Here we have read the Core i7 architecture Nehalem, it’s just a beginning. More products are to be released in the following years that will lead to more energy-efficient computing.

Read more

Be alert: "BubbleBoy is back!"

Do not open e-mail messages with the subject line “BubbleBoy is back”. The e-mail message could be infected with a dangerous new virus Bubble boy. The body of the message says "The BubbleBoy incident, pictures and sound" with the subject line “BubbleBoy is back!". 

The message looks like this: 

Here is some information about BubbleBoy: 
Discovery date: November 9, 1999
Date of latest update: February 13, 2007 11:33:09 AM
Other names for the virus:
VBS/BubbleBoy@MM [McAfee], I-Worm.BubbleBoy [AVP], VBS_BUBBLEBOY [Trend], VBS/BubbleBoy.Worm [CA], VBS/BubbleBoy [Panda], VBS/BubbleBoy-A [Sophos]
Type: Worm, Virus
Systems Affected: 
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

This worm affects English and Spanish versions of Windows 98 and Windows 2000 and Windows 95. It affects Windows 95, only if the Windows Scripting Host is installed. If you are a Window NT user, then no need to worry as, it does not work under Windows NT. It needs Microsoft Outlook or Express with Internet Explorer 5 to propagate. 

Any attachment needs not to be opened or executed in order to activate the virus. In Microsoft Outlook, it gets executed if a victim simply opens the e-mail. In Outlook 2000, you must open the e-mail message for the virus to spread; in Outlook 98 and Outlook Express the virus is activated if the Preview Pane is used.  Other email programs such as MS Exchange and Lotus Notes are also vulnerable to this threat.

The worm utilizes a known security hole in Microsoft Outlook/IE5 to insert a script file, Update.hta, when the email is viewed. 

How does it work?

• The worm attempts to create two files, "C:\WINDOWS\START MENU\PROGRAMS\STARTUP\UPDATE.HTA" and "C:\WINDOWS\MENU INDICIO\PROGRAMS\INICIO\UPDATE.HTA". Update.hta is placed in the StartUp folder. 
• Update.hta is a script file that runs when the system gets restarted .Then the worm uses ActiveX feature to access the system registry.
•  Once activated, the virus assumes Seinfeld themes, changing the name of the computer’s owner to BubbleBoy, and the company name is changed to Vandelay Industries.
• Finally the worm displays the following message:  

"System error, delete "UPDATE.HTA" from the startup folder to solve this problem."

It is a self replicating worm virus that reads user's Outlook address book and mails itself to addresses it finds. When this message appears to the user, the infected e-mails have been sent to all recipients already. 

How to prevent it from propagating?

If you receive a message with the subject heading "BubbleBoy is back!” you should delete it immediately and empty your Deleted Items folder. You can check the system manually. If the file "UPDATE.HTA" is present in the "C:\windows\start menu\programs\startup" folder, your PC is infected with this virus. 

Microsoft provides a security patch that prevents the worm from propagating. You can download the Update for Scriptlet.Typelib and Eyedog Security Vulnerability patch to prevent the BubbleBoy virus from affecting your system. You should install this security patch after deleting the BubbleBoy infected files. You can also try the major anti-virus software; they let you catch the virus before infecting your system.

Read more