Exchange services keep stopping!

[torin8]

Running Exchange 2000 on W2K server. Had an error message saying that the cidaemon.exe had a reference memory address error. After this (even after a reboot) Exchange seems to be falling over repeatedly with errors in the event log saying that the following services are being unexpectedly terminated:

http://WWW Publishing

SMPT
Microsoft Routing engine
NNTP
Pop3
FTP
IMAP4
IIS Admin

Thought it might be the codered II virus but have scanned for this but it's not there and I'm pretty much stuck! Would appreciate any help as its getting desperate!

 

[quell]

Whats the event viewer say? Please post. Look right before all the unexpectedly terminated errors.

 

[torin8]

Thanks for the reply seem to have nailed it down to being the Sophos puremessage program. Disabled the service and rebooted the server and it seems to be behaving. Sophos aren't sure what in Puremessage is causing the problem but say is maybe the VSAPI in exchange which may be interfering - any idea what this is?

The errors I get before it crashes are:

Event ID 1, Source IISCTLS - IIS start command received from user NT AUTHORITY\SYSTEM. The logged data is the status code.

Event ID 2, Source IISCTLS - IIS stop command received from user NT AUTHORITY\SYSTEM. The logged data is the status code.

Event ID 101, Source NNTPSVC- The server was unable to add the virtual root '/' for the directory '/Internet Newsgroups' due to the following error: The parameter is incorrect. The data is the error code.

Seems both I and Sophos are mystified on this one, going to try and disable the VSAPI when I get some downtime and then report back to Sophos but would appreciate any input from anyone else on this!
Thanks

 

[skamruddin]

Had this error for about 6 months. I am not so sure that it is because of Sophos. We donot have Sophos installed but still had the same problems that you have. Tried all sorts of upgarde and Anti- Virus Softwares but could not get rid of the problem. Finally, it went away as mysteriously as it had come. To this day cannot figure out the exact cause.

 

[torin8]

Finally after trying a few things suggested by Sophos it seems to be that there is a problem with the 'Puremessage' anti-virus/spam program. Sophos are currently working on a patch for it but in the meantime I have been advised to disable my VSAPI setting in the registry. Having done this, the exchange server (after a reboot) came back up and stayed up. The only drawback of this is that it disables your realtime scanning of the exchange information store.

 

[Tim2256]

We had this problem and it was caused by one message stuck in the \program files\exchsrvr\mailroot\vis 1\queue folder
once I deleted that message all services were able to start and stay started.