Microsoft KB Archive/842000

= The Microsoft Exchange Information Store service repeatedly quits in Exchange 2000 Server and in Exchange Server 2003 =

Article ID: 842000

Article Last Modified on 10/25/2007

-

APPLIES TO


 * Microsoft Exchange Server 2003 Enterprise Edition
 * Microsoft Exchange Server 2003 Standard Edition
 * Microsoft Exchange 2000 Enterprise Server
 * Microsoft Exchange 2000 Server Standard Edition

-





SYMPTOMS
On your Microsoft Exchange 2000 Server or on your Microsoft Exchange Server 2003 computer, the Microsoft Exchange Information Store service may quit unexpectedly or may stop responding. Additionally, you may experience all the following symptoms:   If you are running Exchange in a clustered environment, the information store may unexpectedly fail over to another cluster node. In this scenario, the following event appears in the application log in Event Viewer: Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7031

Date:

Time:

User: N/A

Computer:

Description: The Microsoft Exchange Information Store service terminated unexpectedly. It has done this  time(s). The following corrective action will be taken in 0 milliseconds: No action. Additionally, the following information may appear in the cluster log file:

0000096c.00000e9c::2004/05/02-01:33:04.463 Microsoft Exchange Information Store : [EXRES]EcStoreIsAlive RPC exception occurred in call to EcAdminStoreGetVMStatus with status code 1753 (0x6d9)

 If you restart the Microsoft Exchange Information Store service, the service runs successfully but then quits again at a random interval. If you disable your antivirus program, the Microsoft Exchange Information Store service no longer quits unexpectedly.



CAUSE
This issue may occur when your antivirus program scans e-mail messages that contain LHarc archives.

The LHa algorithm is used to pack and unpack LHarc archive files. Certain e-mail antivirus scanning packages implement the LHa algorithm and run it automatically when they scan e-mail messages that contain attached files. However, the typical implementation of LHa that certain antivirus programs use in their code has memory corruption issues. Because of this, a malicious user can cause certain antivirus packages to crash when they scan certain e-mail attachments. When this issue occurs, the Microsoft Exchange Information Store service quits or stops responding.



RESOLUTION
To resolve this issue, contact your antivirus program vendor for a possible update to your antivirus program. For information about how to contact software vendors, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and Software Third-Party Vendor Contact List, A-K

60781 Hardware and Software Third-Party Vendor Contact List, L-P

60782 Hardware and Software Third-Party Vendor Contact List, Q-Z

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.



WORKAROUND
To work around this issue, configure your antivirus program to block .lha message attachments.

