IMC Error Messages

[ashleym]

I recently deletd over a gig and a half from the exchsrvr\imcdata\log directory as per an MS KB article (cant remember the Q#) now I am getting critital event ID's 4093 and 4128. 4128 says the IMC is shutting down, but it does not seem to do so. These two events always correspond with another critical event ID from Norton Antivirus Corporate Edition 7.5, saying it has found the VBS Loveletter virus, then the next event says that the system cannot find the file specified and this is an unexpected error and the IMS is shutting down, the next event ID is "The error code 2 was returned when trying to remove the spool file [drive letter]\exchsrvr\imcdata\in\T5PARAN7. The file may cause duplicate mail to be sent when the server is restarted."

There doesn't seem to be any pattern to it.

Anyone have any ideas?

Thanks
Ashley

 

[yizhar]

HI!

If you have NAV on an Exchange server, you should exclude all \EXCHSRVR and subfolders from the normal file scanner.
(or at the minimum exclude data work folders).
Let NAVMSE scan the emails in conjuction with Exchange.
If NAV "takes" a file out of Exchange hands, Exchange can get confused.
Even if it is infected it shoud be handled by NAVMSE (NAV for Exchange) and not by the file based anti virus.

Bye
Yizhar


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[ashleym]

Thanks for your advice, however the NAVCE that is running on the exchange server will catch virus's that NAV for Exchange will not. Also, NAV for Exchange 2.1 for EXS 5.5 has a max auto update of 10 times, according to Symantec the only way to get around this limitation,it to install the NAV CE server client on the server, then however many times it is update, NAV for Exchange will be updated too.

Ashley

 

[JWilliams]

If it is witin your budget, get new a/v software. We run Trend ScanMail and it is awesome. I have it set to update the pattern every night and block certain extentions. I did manual updates three times last week for the Nimda virus. We havn't been hit by a virus since we started using it after our Loveletter outbreak.

If it is not within your budget, you still need to stop using file based scanning on your Exchange server files. If you were to call Microsoft with your problem, this would be the first thing they would tell you to do.

Why are you running file based scanning on your Exchange server? Is it a multi-purpose server? Just curious.

Jessica

 

[ashleym]

We just recently moved away from McAfee to NAC CE, so it is not within the budget. We are using file based scanning on the Exchange server for the simple reason that it is capable of being updated daily, which in turn updates the NAV for Exchange, whereas the NAV for Exchange can only be updated 10 times a month. I know it is a good reason to move away from NAV, but we like it.

I have already excluded all of the EXCHSRVR directories and the problem has gone away.

Thanks to everyone for their help and their feedback.

Ashley