Event ID's 4093 and 4128 1

[age]

I am getting the following two errors in the event log of my exchange 5.5 enterprise server, service pack 4, running on windows 2000 server:

Source: MSExchangeIMC
Category: Internal Processing
Event ID: 4093
The error code Z was returned when trying to remove the spool file d:\EXCHSRVR\imcdata\in\X60BVVB8. This file may cause duplicate mail to be sent when the server is restarted.

and,

Source: MSExchangeIMC
Category: Internal Processing
Event ID: 4128
Failure setting file attributes on file d:\EXCHSRVR\imcdata\in\X60BVVC5. The error code returned was The system cannot find the file specified. This is an unexpected error and the IMS is shutting down.

I've looked both of these up on technet, but couldn't find any relevant entries.

Any ideas??

Thanks.

Adrian.

 

[Zelandakh]

You have mail stuck in the IMC queue. I think this is solved by stopping the services and making sure that imcdata\in is empty then restarting, but I can't recall what that does to the integrity of the logs.

 

[age]

Hi, the queue is empty, the server has been restarted, and the error event ID 4093 is still occurring. It seems to me that it's trying to delete something that isn't there, and hence the error message. Any ideas how I can fix this?

Thanks for your help.

Adrian.

 

[age]

I think I've found the problem on our server. We have Groupshield installed on the server which is scanning emails for viruses, and we also have Netshield installed which scans the hard disks for viruses. When an email comes into the Internet Mail Connector it gets put into the imcdata\in directory on the hard disk. At this point, Netshield scans it as a file, finds the virus, and renames the file to a .vir file. Therefore, when Exchange tries to process the message it can't find it because it's been renamed by Netshield!! The virus doesn't even get as far as being scanned by Groupshield!!!

doh.

 

[buztwet]

I'm responding to an old message, but hopefully someone out there can answer this...I'm getting the same two messages. I'm using Exchange 5.5 and Norton AntiVirus Corp 7.x. Is there any way to fix this or should I just not worry about the error messages?

 

[schazz]

If your AV software allows, exclude the scanning of imcdata\in and imcdata\out.
I'm using Trend Server Protect which has this setting.

 

[bulkmail]

you need to exclude NS from scanning the GS dirs.
Do not scan edb files and transaction logs.
mdbdata = exclude
imcdata = exclude
dsadata = ex
any .log files

BM

 

[nkrst1]

I am having the same issue; however, if I stop my NAV Real Time Scan (which fills the quarantine and causes the error above) from scanning imcdata, dsadata, & mdbdata, viruses get through, especially MyDoom attachments. Any other thoughts/suggestions?

 

[Kroer]

Symantec suggests the following:
Windows 2000 server
Event Viewer – Application Log
Error MSExchangeIMC Event=4093 og 4128
Preventing Symantec or Norton AntiVirus Corporate Edition from scanning the Microsoft Exchange directory structure
Situation:
You need to prevent Symantec or Norton AntiVirus Corporate Edition from scanning the Microsoft Exchange directory structure to avoid problems with the IMC or IS.

Solution:
Symantec Corporate Edition products can only protect the file system on an Exchange server but not Exchange itself. The following sections provide details on which folders can be safely scanned and which folders need to be excluded from the scans when Norton AntiVirus Corporate Edition and other Symantec products are installed.

File system antivirus software can safely scan the following folders
• Exchsrvr\Address
• Exchsrvr\Bin
• Exchsrvr\Conndata
• Exchsrvr\Exchweb
• Exchsrvr\Res
• Exchsrvr\Schema

File system antivirus software should not scan the following

Exchange 5.5
• Exchange databases (the original location is the Exchsrvr\Mdbdata folder)
• Exchange MTA files (Exchsrvr\Mtadata folder)
• Exchange temporary files (tmp.edb) - (this file may be in more than one location)
• Additional log files (Exchsrvr\server_name .log) - may not find on 5.5
• Site Replication Service (SRS) files (Exchsrvr\Srsdata folder) - may not find on 5.5
• Inbox for Internet Mail Connector (Exchsrvr\IMCDATA\IN folder) - Microsoft Exchange 5.5
• Internet Information Service (IIS) system files (<drive>:\Winnt\System32\Inetsrv folder)
• Outbox for Internet Mail Connector (Exchsrvr\IMCDATA\OUT folder)

 

[bulkmail]

nkrst1,

Have you tried blocking by subject? Sorry I do not know any other way. Kinda defeats the purpose of AV if it can't protect everything.

Thanks,

BM