Hey, A new eventwarning startedshowing up after we upgraded from RTM toExchange 2007 SP1,Rollup 2. Both our Mailbox servers get this - Event ID:9874, Event Type:WarningEvent Source:MSExchangeISEvent Category:Virus Scanning Event ID:9874Date:23-05-2008Time:07:49:51User:N/AComputer:CLUSTERSERVERNAMEDescription:Unexpected error 0x80040109 occurred in "EcProcessVirusScanQueueItem" during virus scanning. Mailbox Database: /o=RN/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=SERVERNAME/cn=Microsoft Private MDB Folder ID: 1-3CD6A5A2D Message ID: 1-F03BDC9A6B For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. We use Antivirus software som ETrust 8.1 File-Level Antivirus Scanning Exclusions have been set Anyone have a clue where to start looking? or is this ageneral error to SP1 ? I heard it will be fixed with Rollup 4 - thats true ? Regards Anders Jensen

Hi, You are right. It has been reported as a bug (bug id:139535)to Microsoft Product Team. Also nodetail solutionhas been made for this bug. You may try to contact CSS -Customer Service and Support (CSS) for further assistance. For more information on available CSS services, please click here: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607.) We will be pleaseure to hear your feedback. Good luck. Xiu

Hi,is this bug already fixed in Exchange 2007 Update Rollup 3 ?I have a "similar" problem. I have a product with a VSAPI Job on a Mailbox only Role. Exchange2007SP1 Update Rollup2Researches from me brought the result that the Code 0x80004005 has always something to do with permission problem. In my researches I can't find something special about Event ID: 9874 AND Code 0x80004005. Event Type: Warning Event Source: MSExchangeIS Event Category: Virus Scanning Event ID: 9874 Date: 10.07.2008 Time: 10:47:30 User: N/A Computer: EX07CLUSTERN1 Description: Unexpected error 0x80004005 occurred in "EcProcessVirusScanQueueItem" during virus scanning. Mailbox Database: /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=Ex07MB1/cn=Microsoft Public MDB Folder ID: 1-318C360 Message ID: 1-B5309A5B68 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Is this the same problem like the poster above has? Do you have any idea what the cause of this error mesage, and what can I do to resolve the issue? Thanks for your Help. Greetings Jan Hndle

I have tried everything including disabling the file level AV on our server. We are getting: WinEvtLog: Application: WARNING(9874): MSExchangeIS: (no user): no domain: ESMAWMS1: Unexpected error 0x80040109 occurred in "EcProcessVirusScanQueueItem" during virus scanning. Mailbox Database: /o=Group/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=ServerName/cn=Microsoft Private MDB Folder ID: 15-A51C Message ID: 1-12E2ECD2A3 Its really annoying when there is no documentation for this from Microsoft. We are running Exch 2007 SP1 with all updates as of 10/22. McAfee Enterprise with latest Patch (6 i think) and using Groupshield with the latest updates and patches. Still no information out there on how to resolve this warning. -Derek Morris

We have the same error on both of our mailbox servers with Exchange 2007 SP1 and one has update rollup 3 and one does not, plus Groupshield 6.0. Has anyone tried Update Rollup 4 to fix it? I'm weary of installing something so new but if it fixes the problem I may have to.

I have 4 mailbox servers with the same issue. FYI, SP1 Rollup 5 makes no difference to this issue.

I have done many exchange installations. This is the first I noticed. This is also the first server i have run into that uses groupshield. I'm guessing it is something we have in common? I usually see symantec. Lets hear a vote on what anti-virus product you are using?

I have had the same problem with Groupshield 7.0. RU 5 has been applied to all exchange servers but the warnings still exist. Kind of annoying it fills up the event log.