Event IDs: 4128 and 4093

[PatrickR]

I am getting the following two errors logged every half hour. The file name for each pair of errors changes. I haven't had any reports of a problem. I can't find anything on the MS site or ntfaq.com/windows2000faq.com for these:<br><br>Event ID: 4128<br>Source: MSExchangeIMC<br>Category: Internal Processing<br>Failure setting file attributes on file D:\exchsrvr\imcdata\in\PDTM0TA4.&nbsp;&nbsp;The error code returned was The system cannot find the file specified.<br>.&nbsp;&nbsp;This is an unexpected error and the IMS is shutting down.<br><br>Event ID: 4093<br>Source: MSExchangeIMC<br>Category: Internal Processing<br>The error code 2 was returned when trying to remove the spool file D:\exchsrvr\imcdata\in\PDTM0TA4. This file may cause duplicate mail to be sent when the server is restarted.<br><br>Any help will be appreciated.

 

[PghMikeH]

Make sure your virus scanning software isn't putting a lock on them. That's what ArcservshIT did to us. <p> Mike Hillwig<br><a href=mailto:mike@hypermike.com>mike@hypermike.com</a><br><a href=

http://www.hypermike.com>Hypermike.com</a><br>I've

done more R5 deployments than I care to think about.

 

[PatrickR]

That was the problem. A colleague noticed the problem a day earlier. After I posted the message I found out the cause. It appears Groupshield was catching a virus coming in and stopping it part of the way through Exchange processing it. Once it eliminated it the entire message could not be processed and that's where the errors came from. That's how the whole thing started.<br>Thanks for the response and I definitely agree with your assessment of ArcserveIT. I'll have to remember that one.<br>

 

[age]

Hi, how did you fix this problem in the end? It's just started happening on one of my servers because groupshield is blocking messages loaded with the BadTrans virus, but it is keeping them in the inbound IMC queue. Any ideas on how to make it deal with infected emails a bit better??

Thanks.

Adrian.

 

[age]

I think I've found the problem on our server. We have Groupshield installed on the server which is scanning emails for viruses, and we also have Netshield installed which scans the hard disks for viruses. When an email comes into the Internet Mail Connector it gets put into the imcdata\in directory on the hard disk. At this point, Netshield scans it as a file, finds the virus, and renames the file to a .vir file. Therefore, when Exchange tries to process the message it can't find it because it's been renamed by Netshield!! The virus doesn't even get as far as being scanned by Groupshield!!!

doh.

 

[PatrickR]

That is exactly what's happening. Glad you were able to find the problem.