Re: Exchange 2000 Information store error
- From: "Zoran" <zmarjanovic@xxxxxxxx>
- To: exchangelist@xxxxxxxxxxxxx
- Date: Wed, 4 Feb 2004 05:52:03 -0700
Hi Shoeb,
did this start after you installed post sp3 pack? Try to uninstall it and
monitor the system for couple of days. If it repeat then reinstall sp3. If
you use another software on exchange (AV filter/client or else) it could
be incompatible with some fixes released after your third party software
was released. Also you could try to find the latest upgrade for the
software in question and keep using post sp3 pack.
Zoran
> Hi,
>
> I have a single domain with exchange 2000 installed and updated with
> post sp3 pack. I am getting the following errors which make exchange to
> stop momentarily and I could not find any solutions for this. I checked
> on Microsoft site and there was only one solutions for this error is to
> update the service pack 3 with post update sp3 pack, which I did, the
> result only to reduce the frequency of the following error
>
> Event ID : 7031
>
> Description :
>
> The microsoft Exchange Information store service terminated
> unexpectedly. It has done this 1 times. The following corrective action
> will be taken in 60000 milliseconds. Restart the service.
>
>
> This error is repeating atleast thrice a day.
>
> Best Regards
>
> Shoeb=20
> Senior Network Engg.
> Edi Technology, LLC
> office (971) 4-2865010
> shoeb@xxxxxxxxxxxxxxxxxx
>
>
> -----Original Message-----
> From: Zoran [mailto:zmarjanovic@xxxxxxxx]=20
> Sent: Wednesday, February 04, 2004 1:11 PM
> To: [ExchangeList]
> Subject: [exchangelist] Re: Exchange 2003 - Event ID 3030 Source
> MSExchangeTransport[Scanned]
>
> http://www.MSExchange.org/
>
> Hi Simon,
>
> check KB 256321, it says: X.1.8 Bad sender's system address (status code
> of 5.1.8 was generated for
> recipient rfc822;jack@xxxxxxxxxx).
>
> It is very possible you have an intruder. Chech your net with antitrojan
> software. Also check your DNSs and logs of SMTP.
>
> Zoran
>
> > =3D20
> > Raj,
> >=20
> > All ready checked for the virus and all machines are clear. Plus all
> > machines are swept at night by a scheduled task and the results are
> then
> > sent to myself.
> >=20
> > Regards
> > Simon Whale
> > -----Original Message-----
> > From: Periyasamy, Raj [mailto:Raj.Periyasamy@xxxxxxxxxxxx]=3D20
> > Sent: 03 February 2004 16:52
> > To: [ExchangeList]
> > Subject: [exchangelist] Re: Exchange 2003 - Event ID 3030 Source
> > MSExchangeTransport[Scanned]
> >=20
> > http://www.MSExchange.org/
> >=20
> > It sounds like you may have the MyDoom virus going around. My Doom
> tries
> > to spoof sender IDs and recipient IDs. It may not be that the actual
> > virus originated from your user, but might have spoofed elsewhere. In
> > any case run a thorough check of your user PC, and the Exchange
> server.
> >=20
> >=20
> > Regards,
> >=20
> > Raj
> >=20
> > -----Original Message-----
> > From: simon whale [mailto:swhale@xxxxxxxxxxxxxx]
> > Sent: Tuesday, February 03, 2004 11:41 AM
> > To: [ExchangeList]
> > Subject: [exchangelist] Re: Exchange 2003 - Event ID 3030 Source
> > MSExchangeTransport[Scanned]
> >=20
> >=20
> > http://www.MSExchange.org/
> >=20
> > Zoran,
> >=20
> > Thanks for your time. There is no logging switched on in the smtp
> > connector. I have just received another.
> >=20
> > Event Type: Error
> > Event Source: MSExchangeTransport
> > Event Category: NDR=3D20
> > Event ID: 3030
> > Date: 03/02/2004
> > Time: 16:35:25
> > User: N/A
> > Computer: JUPITER
> > Description:
> > A non-delivery report with a status code of 5.1.8 was generated for
> > recipient rfc822;jack@xxxxxxxxxx (Message-ID
> > <16a201c3ea73$b8b9d170$02010a0a@xxxxxxxxxxxx>). =3D20
> >=20
> > But at the same time my anti virus also reported a virus from the same
> > person:
> >=20
> > A suspicious mail was processed.
> >=20
> > Event: infection=3D20
> > Action: Message quarantined=3D20
> > Message ID: <200402031631.i13GVdv25012@xxxxxxxxxxxxxxxxx>=3D20
> > Message subject: test=3D20
> > Sender: "jack@xxxxxxxxxx" <jack@xxxxxxxxxx>
> > Recipient: "fred@xxxxxxxxxxxxxx" <fred@xxxxxxxxxxxxxx>=3D20
> >=20
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> > =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> >=20
> > Attachment information:
> > Event: infection =3D20
> > Action: Unable to disinfect=3D20
> > Filename: data.zip=3D20
> > Virus: W32/MyDoom-A=3D20
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> > =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> >=20
> > Attachment information:
> > Event: infection =3D20
> > Action: Unable to disinfect=3D20
> > Filename: data.zip=3D20
> > Virus: W32/MyDoom-A=3D20
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> >
> =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
> 3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> =3D3D=3D
> > =3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
> >=20
> > Can I assume that these events logged for addresses that don't exist?
> O
> > runalbe ot contact?
> >=20
> > Regards
> > Simon Whale
> > -----Original Message-----
> > From: Zoran [mailto:zmarjanovic@xxxxxxxx]=3D20
> > Sent: 03 February 2004 16:52
> > To: [ExchangeList]
> > Subject: [exchangelist] Re: Exchange 2003 - Event ID 3030 Source
> > MSExchangeTransport[Scanned]
> >=20
> > http://www.MSExchange.org/
> >=20
> > Hi Simon,
> >=20
> > check diagnostics logging level for MSExchangeTransport.
> >=20
> > Zoran
> >=20
> > > All,
> > >=3D20
> > > I have just noticed the following in the event viewer, can anybody
> > > shed any light on the matter?
> > >=3D20
> > > Event Type: Error
> > > Event Source: MSExchangeTransport
> > > Event Category: NDR=3D3D20
> > > Event ID: 3030
> > > Date: 03/02/2004
> > > Time: 15:35:34
> > > User: N/A
> > > Computer: JUPITER
> > > Description:
> > > A non-delivery report with a status code of 5.1.8 was generated for
> > > recipient rfc822;joe@xxxxxxxxxxxxxxxxxx (Message-ID=3D20
> > > <168401c3ea6b$5ad73780$02010a0a@xxxxxxxxxxxx>). =3D3D20
> > >=3D20
> > > Have checked on google groups, eventid.net and microsoft to no
> > success.
> > >=3D20
> > > Setup as follows
> > >=3D20
> > > Windows 2003 (patched upto date)
> > > Exchange 2003 (patched upto date)
> > > Sophos Anti Virus - Mail monitor (up to date)
> > >=3D20
> > > Many Thanks
> > > Simon
> >=20
> > ------------------------------------------------------
> > List Archives: =3D
> > http://www.webelists.com/cgi/lyris.pl?enter=3D3Dexchangelist
> > Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> > Exchange FAQ: =
> http://www.msexchange.org/pages/larticle.asp?type=3D3DFAQ
> > ------------------------------------------------------
> > Other Internet Software Marketing Sites:
> > Leading Network Software Directory: http://www.serverfiles.com No.1
> ISA
> > Server Resource Site: http://www.isaserver.org Windows Security
> Resource
> > Site: http://www.windowsecurity.com/ Network Security Library:
> > http://www.secinf.net/ Windows 2000/NT Fax Solutions:
> > http://www.ntfaxfaq.com
> > ------------------------------------------------------
> >=20
> >=20
> >=20
> >=20
> >=20
> > ------------------------------------------------------
> > List Archives: =3D
> > http://www.webelists.com/cgi/lyris.pl?enter=3D3Dexchangelist
> > Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> > Exchange FAQ: =
> http://www.msexchange.org/pages/larticle.asp?type=3D3DFAQ
> > ------------------------------------------------------
> > Other Internet Software Marketing Sites:
> > Leading Network Software Directory: http://www.serverfiles.com No.1
> ISA
> > Server Resource Site: http://www.isaserver.org Windows Security
> Resource
> > Site: http://www.windowsecurity.com/ Network Security Library:
> > http://www.secinf.net/ Windows 2000/NT Fax Solutions:
> > http://www.ntfaxfaq.com
> > ------------------------------------------------------
> >=20
> >=20
> > ------------------------------------------------------
> > List Archives: =3D
> > http://www.webelists.com/cgi/lyris.pl?enter=3D3Dexchangelist
> > Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> > Exchange FAQ: =
> http://www.msexchange.org/pages/larticle.asp?type=3D3DFAQ
> > ------------------------------------------------------
> > Other Internet Software Marketing Sites:
> > Leading Network Software Directory: http://www.serverfiles.com
> > No.1 ISA Server Resource Site: http://www.isaserver.org
> > Windows Security Resource Site: http://www.windowsecurity.com/
> > Network Security Library: http://www.secinf.net/
> > Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> > ------------------------------------------------------
>
> ------------------------------------------------------
> List Archives: =
> http://www.webelists.com/cgi/lyris.pl?enter=3Dexchangelist
> Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=3DFAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 ISA Server Resource Site: http://www.isaserver.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
Other related posts:
