Member Avatar for ingrammusic

My antivirus scanner found a few viruses with on our exchange server. The files had a .eml extension and they were located in the " \Progam Files\Exchsrvr\Mailroot\vsi2\UceArchive" folder. I assume they are emails, but what is this folder for and why are there 2GB of .eml files in it?

  • 2 Contributors
  • 1 Reply
  • 241 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by JustinNH

Dani AI

Generated

Short answer: that folder is the Exchange "UCE Archive" used by the Intelligent Message Filter (IMF) to store messages the server classifies as UCE/spam when the IMF action is set to Archive. The files are raw message files (.eml/.msg) and can grow quickly on a busy gateway — which explains the multi‑GB accumulation found. ()

Why your AV saw "viruses": those .eml files contain the original message and attachments, so an on‑access scanner will detect any infected attachments inside archived mail. On‑access scanning of the archive can also hold files open and interfere with tools that read the archive, so administrators often handle that folder differently (scan on demand or with a scheduled/isolated task rather than leaving aggressive real‑time scanning enabled). (exchange.sembee.info)

Quick, safe steps to deal with it:

  • Don’t blindly delete the folder — inspect before removing. Use an IMF archive viewer (IMF Archive Manager or similar) to preview, delete, or resubmit messages to the pickup queue. ()
  • If the archive is legitimately large, move it to another volume by creating the registry string value ArchiveDir under HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ContentFilter and restarting SMTP. You can also add ArchiveSCL (DWORD=1) under the same key to preserve the SCL in archived messages. (exchange.sembee.info)
  • For infected items: quarantine/delete them (or scan copies), clean any affected systems, then consider purging older archive files safely (after a backup).

Concluding notes: was right in calling it the spam archive, but the practical response is inspection + controlled cleanup, not immediate deletion. If this is an Exchange 2003/IMF deployment, check the ContentFilter registry settings (there was a known SP2 issue where the key must be created manually). Back up first, and adjust antivirus/retention policy so the archive no longer surprises you with unexpected disk usage. (blog.mpecsinc.ca)

Member Avatar for JustinNH

My antivirus scanner found a few viruses with on our exchange server. The files had a .eml extension and they were located in the " \Progam Files\Exchsrvr\Mailroot\vsi2\UceArchive" folder. I assume they are emails, but what is this folder for and why are there 2GB of .eml files in it?

Spam archive folder.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.