RE: Exchange 2000 Information store error

  • From: "Zoran" <zmarjanovic@xxxxxxxx>
  • To: exchangelist@xxxxxxxxxxxxx
  • Date: Wed, 4 Feb 2004 08:19:49 -0700

MCAfee client or filter for exchange (exchange aware)? If you use client
and realtime protection, then exclude: Exchsrvr folder, inetsrv, M drive,
temp folder of AV software (if cannot find it exclude the main mcafee
folder in program files), and databases if they are not on default
location (Exchsrvr>MDBDATA).

Zoran

> I am using Mcafee for exchange
> 
> Best Regards
> 
> =20
> 
> Shoeb=20
> 
> Senior Network Engg.
> 
> Edi Technology, LLC
> 
> office (971) 4-2865010
> 
> shoeb@xxxxxxxxxxxxxxxxxx
> 
> 
> -----Original Message-----
> From: Periyasamy, Raj [mailto:Raj.Periyasamy@xxxxxxxxxxxx]=20
> Sent: Wednesday, February 04, 2004 6:00 PM
> To: [ExchangeList]
> Subject: [exchangelist] RE: Exchange 2000 Information store error
> 
> http://www.MSExchange.org/
> 
> Shoeb, are you running any file level antivirus software in the server ?
> If so make sure the M: drive is not being scanned.
> 
> Regards,
> 
> Raj
> 
> 
> -----Original Message-----
> From: shoeb [mailto:shoeb@xxxxxxxxxxxxxxxxxx]=20
> Sent: Wednesday, February 04, 2004 4:38 AM
> To: [ExchangeList]
> Subject: [exchangelist] Exchange 2000 Information store error
> 
> 
> http://www.MSExchange.org/
> 
> Hi,
> 
> I have a single domain with exchange 2000 installed and updated with
> post sp3 pack. I am getting the following errors which make exchange to
> stop momentarily and I could not find any solutions for this. I checked
> on Microsoft site and there was only one solutions for this error is to
> update the service pack 3 with post update sp3 pack, which I did, the
> result only to reduce the frequency of the following error
> 
> Event ID : 7031
> 
> Description :
> 
> The microsoft Exchange Information store service terminated
> unexpectedly. It has done this 1 times. The following corrective action
> will be taken in 60000 milliseconds. Restart the service.
> 
> 
> This error is repeating atleast thrice a day.
> 
> Best Regards
> 
> Shoeb=20
> Senior Network Engg.
> Edi Technology, LLC
> office (971) 4-2865010
> shoeb@xxxxxxxxxxxxxxxxxx
> 
> 
> -----Original Message-----
> From: Zoran [mailto:zmarjanovic@xxxxxxxx]=20
> Sent: Wednesday, February 04, 2004 1:11 PM
> To: [ExchangeList]
> Subject: [exchangelist] Re: Exchange 2003 - Event ID 3030 Source
> MSExchangeTransport[Scanned]
> 
> http://www.MSExchange.org/
> 
> Hi Simon,
> 
> check KB 256321, it says: X.1.8 Bad sender's system address (status code
> of 5.1.8 was generated for recipient rfc822;jack@xxxxxxxxxx).
> 
> It is very possible you have an intruder. Chech your net with antitrojan
> software. Also check your DNSs and logs of SMTP.
> 
> Zoran
> 
> > =3D20
> > Raj,
> >=20
> > All ready checked for the virus and all machines are clear. Plus all=20
> > machines are swept at night by a scheduled task and the results are
> then
> > sent to myself.
> >=20
> > Regards
> > Simon Whale
> > -----Original Message-----
> > From: Periyasamy, Raj [mailto:Raj.Periyasamy@xxxxxxxxxxxx]=3D20
> > Sent: 03 February 2004 16:52
> > To: [ExchangeList]
> > Subject: [exchangelist] Re: Exchange 2003 - Event ID 3030 Source=20
> > MSExchangeTransport[Scanned]
> >=20
> > http://www.MSExchange.org/
> >=20
> > It sounds like you may have the MyDoom virus going around. My Doom
> tries
> > to spoof sender IDs and recipient IDs. It may not be that the actual=20
> > virus originated from your user, but might have spoofed elsewhere. In=20
> > any case run a thorough check of your user PC, and the Exchange
> server.
> >=20
> >=20
> > Regards,
> >=20
> > Raj
> >=20
> > -----Original Message-----
> > From: simon whale [mailto:swhale@xxxxxxxxxxxxxx]
> > Sent: Tuesday, February 03, 2004 11:41 AM
> > To: [ExchangeList]
> > Subject: [exchangelist] Re: Exchange 2003 - Event ID 3030 Source=20
> > MSExchangeTransport[Scanned]
> >=20
> >=20
> > http://www.MSExchange.org/
> >=20
> > Zoran,
> >=20
> > Thanks for your time. There is no logging switched on in the smtp=20
> > connector.  I have just received another.
> >=20
> > Event Type: Error
> > Event Source:       MSExchangeTransport
> > Event Category:     NDR=3D20
> > Event ID:   3030
> > Date:               03/02/2004
> > Time:               16:35:25
> > User:               N/A
> > Computer:   JUPITER
> > Description:
> > A non-delivery report with a status code of 5.1.8 was generated for=20
> > recipient rfc822;jack@xxxxxxxxxx (Message-ID=20
> > <16a201c3ea73$b8b9d170$02010a0a@xxxxxxxxxxxx>). =3D20
> >=20
> > But at the same time my anti virus also reported a virus from the same
> > person:
> >=20
> > A suspicious mail was processed.
> >=20
> >     Event:          infection=3D20
> >     Action:         Message quarantined=3D20
> >     Message ID:     <200402031631.i13GVdv25012@xxxxxxxxxxxxxxxxx>=3D20
> >     Message subject:        test=3D20
> >     Sender:         "jack@xxxxxxxxxx" <jack@xxxxxxxxxx>
> >     Recipient:  "fred@xxxxxxxxxxxxxx" <fred@xxxxxxxxxxxxxx>=3D20
> >=20
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> > =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> >=20
> >     Attachment information:
> >             Event:  infection =3D20
> >             Action: Unable to disinfect=3D20
> >             Filename:       data.zip=3D20
> >             Virus:  W32/MyDoom-A=3D20
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> > =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> >=20
> >     Attachment information:
> >             Event:  infection =3D20
> >             Action: Unable to disinfect=3D20
> >             Filename:       data.zip=3D20
> >             Virus:  W32/MyDoom-A=3D20
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> > =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> >=20
> > Can I assume that these events logged for addresses that don't exist?
> O
> > runalbe ot contact?
> >=20
> > Regards
> > Simon Whale
> > -----Original Message-----
> > From: Zoran [mailto:zmarjanovic@xxxxxxxx]=3D20
> > Sent: 03 February 2004 16:52
> > To: [ExchangeList]
> > Subject: [exchangelist] Re: Exchange 2003 - Event ID 3030 Source=20
> > MSExchangeTransport[Scanned]
> >=20
> > http://www.MSExchange.org/
> >=20
> > Hi Simon,
> >=20
> > check diagnostics logging level for MSExchangeTransport.
> >=20
> > Zoran
> >=20
> > > All,
> > >=3D20
> > > I have just noticed the following in the event viewer, can anybody =20
> > >shed any light on the matter? =3D20
> > > Event Type:       Error
> > > Event Source:     MSExchangeTransport
> > > Event Category:   NDR=3D3D20
> > > Event ID: 3030
> > > Date:             03/02/2004
> > > Time:             15:35:34
> > > User:             N/A
> > > Computer: JUPITER
> > > Description:
> > > A non-delivery report with a status code of 5.1.8 was generated for
> > > recipient rfc822;joe@xxxxxxxxxxxxxxxxxx (Message-ID=3D20
> > > <168401c3ea6b$5ad73780$02010a0a@xxxxxxxxxxxx>). =3D3D20
> > >=3D20
> > > Have checked on google groups, eventid.net and microsoft to no
> > success.
> > >=3D20
> > > Setup as follows
> > >=3D20
> > > Windows 2003 (patched upto date)
> > > Exchange 2003 (patched upto date)
> > > Sophos Anti Virus - Mail monitor (up to date)
> > >=3D20
> > > Many Thanks
> > > Simon
> >=20
> > ------------------------------------------------------
> > List Archives: =3D=20
> > http://www.webelists.com/cgi/lyris.pl?enter=3D3Dexchangelist
> > Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> > Exchange FAQ: =
> http://www.msexchange.org/pages/larticle.asp?type=3D3DFAQ
> > ------------------------------------------------------
> > Other Internet Software Marketing Sites:
> > Leading Network Software Directory: http://www.serverfiles.com No.1
> ISA
> > Server Resource Site: http://www.isaserver.org Windows Security
> Resource
> > Site: http://www.windowsecurity.com/ Network Security Library:=20
> > http://www.secinf.net/ Windows 2000/NT Fax Solutions:=20
> > http://www.ntfaxfaq.com
> > ------------------------------------------------------
> >=20
> >=20
> >=20
> >=20
> >=20
> > ------------------------------------------------------
> > List Archives: =3D=20
> > http://www.webelists.com/cgi/lyris.pl?enter=3D3Dexchangelist
> > Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> > Exchange FAQ: =
> http://www.msexchange.org/pages/larticle.asp?type=3D3DFAQ
> > ------------------------------------------------------
> > Other Internet Software Marketing Sites:
> > Leading Network Software Directory: http://www.serverfiles.com No.1
> ISA
> > Server Resource Site: http://www.isaserver.org Windows Security
> Resource
> > Site: http://www.windowsecurity.com/ Network Security Library:=20
> > http://www.secinf.net/ Windows 2000/NT Fax Solutions:=20
> > http://www.ntfaxfaq.com
> > ------------------------------------------------------
> >=20
> >=20
> > ------------------------------------------------------
> > List Archives: =3D=20
> > http://www.webelists.com/cgi/lyris.pl?enter=3D3Dexchangelist
> > Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> > Exchange FAQ: =
> http://www.msexchange.org/pages/larticle.asp?type=3D3DFAQ
> > ------------------------------------------------------
> > Other Internet Software Marketing Sites:
> > Leading Network Software Directory: http://www.serverfiles.com No.1=20
> > ISA Server Resource Site: http://www.isaserver.org Windows Security=20
> > Resource Site: http://www.windowsecurity.com/ Network Security=20
> > Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:=20
> > http://www.ntfaxfaq.com
> > ------------------------------------------------------
> 
> ------------------------------------------------------
> List Archives: =
> http://www.webelists.com/cgi/lyris.pl?enter=3Dexchangelist
> Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=3DFAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com No.1 ISA
> Server Resource Site: http://www.isaserver.org Windows Security Resource
> Site: http://www.windowsecurity.com/ Network Security Library:
> http://www.secinf.net/ Windows 2000/NT Fax Solutions:
> http://www.ntfaxfaq.com
> ------------------------------------------------------
> 
> 
> 
> 
> ------------------------------------------------------
> List Archives: =
> http://www.webelists.com/cgi/lyris.pl?enter=3Dexchangelist
> Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=3DFAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com No.1 ISA
> Server Resource Site: http://www.isaserver.org Windows Security Resource
> Site: http://www.windowsecurity.com/ Network Security Library:
> http://www.secinf.net/ Windows 2000/NT Fax Solutions:
> http://www.ntfaxfaq.com
> ------------------------------------------------------
> 
> 
> ------------------------------------------------------
> List Archives: =
> http://www.webelists.com/cgi/lyris.pl?enter=3Dexchangelist
> Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=3DFAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 ISA Server Resource Site: http://www.isaserver.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------


Other related posts: