Prev: ActiveSync help
Next: Exchange 2007 Queue
From: Ed Crowley [MVP] on 23 Dec 2008 19:38
It appears you didn't exclude the Exchange directories from antivirus
scanning, a must when you install a file-based antivirus program on an
Exchange server, and it corrupted Exchange. There are no good solutions to
this, I'm afraid to have to tell you. You have a few options, none of them
good.

1. Restore from backup. You will likely lose some of the most recent data.
2. Try to repair the database using ESEUTIL and ISINTEG. This will likely
destroy some data.
3. Try to recover what you can from each user's offline store by having
them copy everything to a PST.
4. Just write it off, delete all the store, log and system files in the
database and storage group directories and restart the store.

You might want to employ a combination of these methods along with some
others I haven't thought of in the brief time I've had to look at your
issue.

You really ought to take this opportunity to read the Microsoft Exchange
Disaster Recovery whitepaper for Exchange 2003 and become familiar with it.
http://technet.microsoft.com/en-us/library/bb125070.aspx

My suggestion at this point would be to contact Microsoft Support and have
them help you through this, or employ a local consultant who is very
experienced at disaster recovery.
--
Ed Crowley MVP
"There are seldom good technological solutions to behavioral problems."
..

"news.microsoft.com" <hear01athotmail.com> wrote in message
news:%23jCS9mSZJHA.3548(a)TK2MSFTNGP05.phx.gbl...
> Exchange 2003 Ent (SP2), Win2K3 (SP2), virtualized in VMWare GSX 3.1.x and
> the only VM on the GSX, AD2008 with both Win2K3 and Win2K8 DCs, AD DNS,
> Wins, DHCP on Win2K3. WinXP clients, Outlook 2003.
>
> Hi
>
> I have a great problem (dont we all ? ;-) ) with my Exchange server.
>
> MSExchangeIS doesnt work correctly.
>
> I started to get event id 1115 -
>
> Error 0xfffffbbe returned from closing database table, called from
> function JTAB_BASE::EcCloseTable on table Syncronization table.
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
> follwed up by 9175 error -
>
> The MAPI call 'OpenMsgStore' failed with the following error:
> The attempt to log on to the Microsoft Exchange Server computer has
> failed.
> The MAPI provider failed.
> Microsoft Exchange Server Information Store
> ID no: 8004011d-0512-00000000
>
>
> Just befoer these errors started to occur i recieved a event id 259 mclog
> event -
> The description for Event ID ( 259 ) in Source ( McLogEvent ) cannot be
> found. The local computer may not have the necessary registry information
> or message DLL files to display messages from a remote computer. You may
> be able to use the /AUXSOURCE= flag to retrieve this description; see Help
> and Support for details. The following information is part of the event:
> Filen E:\Program Files\Exchsrvr\MDBDATA\E00.log\image01111.jpg inneh�ller
> Exploit-QtPICT '_'. Ingen rensningsfunktion finns tillg�nglig s� filen har
> ist�llet tagits bort. Uppt�ckt med genoms�kningsmotor version 5300.2777
> DAT-version 5472.0000..
> (Some of the text Is swedish because of the fact we are using a swedish
> language fil to our McAfee Virusscan Enterpise)
>
> * I have restored the E00.log file from the qurantine and restarted the IS
> but with out success.
> * I have used and followed a link
> http://www.petri.co.il/mount_exchange_database_when_e00log_is_missing.htm
> with out success.
> * I followed and installed the KB from
> http://www.microsoft.com/downloads/thankyou.aspx?familyId=2a835a09-8e57-4027-a488-1e61c4b43a10&displayLang=en
> KB930241
> * Usually the virusprotections i sexcluded from scanning exchange DB and
> log locations but in my case i missed to add a new added disk in vmware to
> the excklusions list and i, after the add, moved the exchange logg files
> to that disk. I have followed http://support.microsoft.com/?kbid=245822
> when excluding files and folders related to Exchange.
>
> Exchange BPA doesnt hit down on anything at all, all issues in BPA were
> fixed during this summer and no new issues were found today.
>
> Attached is a part of the app log file i xls (csv comma delimeted).
> As of now I can start IS but not access the mailserver and the app log
> gets 9175 errors each time the IS is started up after resatrt of services.
>
> During the writing of this thread I have been restoring the Exchange IS
> from the latest backup to a Recovery Storage group In case I dont get the
> current one working.
> This Is not what I prefer due to emails recieved since latest backup.
>
> I need help to get my Exchange back online and would appreciate any
> assistans very much.
>
> Regards and many thanks In advance
>
> P:s This system Is not an SBS D.s
>
> //Henrik (Hear), MCP-SBS,
>
>

From: Henrik (Hear), MCP-SBS on 23 Dec 2008 19:48
Many thanks Ed,

I have takened you suggestion regarding the expert consultant and have
contracted a guy from saturday remotely.
I have restored tha last good backup to e recover storage group on the
exchange server, also, I have made a copy of the virtual machine (The
Exchange server).

I will forward your post to the consultant and I will use it as reference
during the decisions.
I will also read up on the disaster recovery process in the KB you provided
a link to, I have read it before but it was a long time ago. These things
doesnt happen often wich Is good in some way, not good If you need to be
good at it.

I dont close this thread before I know my problem is solved.

Merry Christmas

Regards

Henrik Arenblad


"Ed Crowley [MVP]" <curspice(a)nospam.net> skrev i meddelandet
news:unlFo$VZJHA.4480(a)TK2MSFTNGP06.phx.gbl...
> It appears you didn't exclude the Exchange directories from antivirus
> scanning, a must when you install a file-based antivirus program on an
> Exchange server, and it corrupted Exchange. There are no good solutions
> to this, I'm afraid to have to tell you. You have a few options, none of
> them good.
>
> 1. Restore from backup. You will likely lose some of the most recent
> data.
> 2. Try to repair the database using ESEUTIL and ISINTEG. This will
> likely destroy some data.
> 3. Try to recover what you can from each user's offline store by having
> them copy everything to a PST.
> 4. Just write it off, delete all the store, log and system files in the
> database and storage group directories and restart the store.
>
> You might want to employ a combination of these methods along with some
> others I haven't thought of in the brief time I've had to look at your
> issue.
>
> You really ought to take this opportunity to read the Microsoft Exchange
> Disaster Recovery whitepaper for Exchange 2003 and become familiar with
> it.
> http://technet.microsoft.com/en-us/library/bb125070.aspx
>
> My suggestion at this point would be to contact Microsoft Support and have
> them help you through this, or employ a local consultant who is very
> experienced at disaster recovery.
> --
> Ed Crowley MVP
> "There are seldom good technological solutions to behavioral problems."
> .
>
> "news.microsoft.com" <hear01athotmail.com> wrote in message
> news:%23jCS9mSZJHA.3548(a)TK2MSFTNGP05.phx.gbl...
>> Exchange 2003 Ent (SP2), Win2K3 (SP2), virtualized in VMWare GSX 3.1.x
>> and the only VM on the GSX, AD2008 with both Win2K3 and Win2K8 DCs, AD
>> DNS, Wins, DHCP on Win2K3. WinXP clients, Outlook 2003.
>>
>> Hi
>>
>> I have a great problem (dont we all ? ;-) ) with my Exchange server.
>>
>> MSExchangeIS doesnt work correctly.
>>
>> I started to get event id 1115 -
>>
>> Error 0xfffffbbe returned from closing database table, called from
>> function JTAB_BASE::EcCloseTable on table Syncronization table.
>> For more information, click http://www.microsoft.com/contentredirect.asp.
>>
>> follwed up by 9175 error -
>>
>> The MAPI call 'OpenMsgStore' failed with the following error:
>> The attempt to log on to the Microsoft Exchange Server computer has
>> failed.
>> The MAPI provider failed.
>> Microsoft Exchange Server Information Store
>> ID no: 8004011d-0512-00000000
>>
>>
>> Just befoer these errors started to occur i recieved a event id 259 mclog
>> event -
>> The description for Event ID ( 259 ) in Source ( McLogEvent ) cannot be
>> found. The local computer may not have the necessary registry information
>> or message DLL files to display messages from a remote computer. You may
>> be able to use the /AUXSOURCE= flag to retrieve this description; see
>> Help and Support for details. The following information is part of the
>> event: Filen E:\Program Files\Exchsrvr\MDBDATA\E00.log\image01111.jpg
>> inneh�ller Exploit-QtPICT '_'. Ingen rensningsfunktion finns tillg�nglig
>> s� filen har ist�llet tagits bort. Uppt�ckt med genoms�kningsmotor
>> version 5300.2777 DAT-version 5472.0000..
>> (Some of the text Is swedish because of the fact we are using a swedish
>> language fil to our McAfee Virusscan Enterpise)
>>
>> * I have restored the E00.log file from the qurantine and restarted the
>> IS but with out success.
>> * I have used and followed a link
>> http://www.petri.co.il/mount_exchange_database_when_e00log_is_missing.htm
>> with out success.
>> * I followed and installed the KB from
>> http://www.microsoft.com/downloads/thankyou.aspx?familyId=2a835a09-8e57-4027-a488-1e61c4b43a10&displayLang=en
>> KB930241
>> * Usually the virusprotections i sexcluded from scanning exchange DB and
>> log locations but in my case i missed to add a new added disk in vmware
>> to the excklusions list and i, after the add, moved the exchange logg
>> files to that disk. I have followed
>> http://support.microsoft.com/?kbid=245822 when excluding files and
>> folders related to Exchange.
>>
>> Exchange BPA doesnt hit down on anything at all, all issues in BPA were
>> fixed during this summer and no new issues were found today.
>>
>> Attached is a part of the app log file i xls (csv comma delimeted).
>> As of now I can start IS but not access the mailserver and the app log
>> gets 9175 errors each time the IS is started up after resatrt of
>> services.
>>
>> During the writing of this thread I have been restoring the Exchange IS
>> from the latest backup to a Recovery Storage group In case I dont get the
>> current one working.
>> This Is not what I prefer due to emails recieved since latest backup.
>>
>> I need help to get my Exchange back online and would appreciate any
>> assistans very much.
>>
>> Regards and many thanks In advance
>>
>> P:s This system Is not an SBS D.s
>>
>> //Henrik (Hear), MCP-SBS,
>>
>>
>


From: Henrik (Hear), MCP-SBS on 29 Dec 2008 08:00
hi, an update ..

My problems occured due to a dirty shutdown of my Exchange and there fore my
IS services was running but not the physical IS and Pub store them selves,
they were unmounted.

The log file that were deleted were not to be found and there fore we forced
the uncommitted log files to be commited and ran isinteg and eseutil with
checks. We made the unconsistent DB consisten again and were able to mount
them again. We used the methods in the KB that were provided and they worked
perfectly and the dataloss is only the last E000.log file, and cost that the
company has as an acceptable loss.

Thanks again Ed.

//Henrik ( Hear), MCP-SBS,

"Henrik (Hear), MCP-SBS" <hear01athotmail.com> skrev i meddelandet
news:eF205EWZJHA.5528(a)TK2MSFTNGP02.phx.gbl...
> Many thanks Ed,
>
> I have takened you suggestion regarding the expert consultant and have
> contracted a guy from saturday remotely.
> I have restored tha last good backup to e recover storage group on the
> exchange server, also, I have made a copy of the virtual machine (The
> Exchange server).
>
> I will forward your post to the consultant and I will use it as reference
> during the decisions.
> I will also read up on the disaster recovery process in the KB you
> provided a link to, I have read it before but it was a long time ago.
> These things doesnt happen often wich Is good in some way, not good If you
> need to be good at it.
>
> I dont close this thread before I know my problem is solved.
>
> Merry Christmas
>
> Regards
>
> Henrik Arenblad
>
>
> "Ed Crowley [MVP]" <curspice(a)nospam.net> skrev i meddelandet
> news:unlFo$VZJHA.4480(a)TK2MSFTNGP06.phx.gbl...
>> It appears you didn't exclude the Exchange directories from antivirus
>> scanning, a must when you install a file-based antivirus program on an
>> Exchange server, and it corrupted Exchange. There are no good solutions
>> to this, I'm afraid to have to tell you. You have a few options, none of
>> them good.
>>
>> 1. Restore from backup. You will likely lose some of the most recent
>> data.
>> 2. Try to repair the database using ESEUTIL and ISINTEG. This will
>> likely destroy some data.
>> 3. Try to recover what you can from each user's offline store by having
>> them copy everything to a PST.
>> 4. Just write it off, delete all the store, log and system files in the
>> database and storage group directories and restart the store.
>>
>> You might want to employ a combination of these methods along with some
>> others I haven't thought of in the brief time I've had to look at your
>> issue.
>>
>> You really ought to take this opportunity to read the Microsoft Exchange
>> Disaster Recovery whitepaper for Exchange 2003 and become familiar with
>> it.
>> http://technet.microsoft.com/en-us/library/bb125070.aspx
>>
>> My suggestion at this point would be to contact Microsoft Support and
>> have them help you through this, or employ a local consultant who is very
>> experienced at disaster recovery.
>> --
>> Ed Crowley MVP
>> "There are seldom good technological solutions to behavioral problems."
>> .
>>
>> "news.microsoft.com" <hear01athotmail.com> wrote in message
>> news:%23jCS9mSZJHA.3548(a)TK2MSFTNGP05.phx.gbl...
>>> Exchange 2003 Ent (SP2), Win2K3 (SP2), virtualized in VMWare GSX 3.1.x
>>> and the only VM on the GSX, AD2008 with both Win2K3 and Win2K8 DCs, AD
>>> DNS, Wins, DHCP on Win2K3. WinXP clients, Outlook 2003.
>>>
>>> Hi
>>>
>>> I have a great problem (dont we all ? ;-) ) with my Exchange server.
>>>
>>> MSExchangeIS doesnt work correctly.
>>>
>>> I started to get event id 1115 -
>>>
>>> Error 0xfffffbbe returned from closing database table, called from
>>> function JTAB_BASE::EcCloseTable on table Syncronization table.
>>> For more information, click
>>> http://www.microsoft.com/contentredirect.asp.
>>>
>>> follwed up by 9175 error -
>>>
>>> The MAPI call 'OpenMsgStore' failed with the following error:
>>> The attempt to log on to the Microsoft Exchange Server computer has
>>> failed.
>>> The MAPI provider failed.
>>> Microsoft Exchange Server Information Store
>>> ID no: 8004011d-0512-00000000
>>>
>>>
>>> Just befoer these errors started to occur i recieved a event id 259
>>> mclog event -
>>> The description for Event ID ( 259 ) in Source ( McLogEvent ) cannot be
>>> found. The local computer may not have the necessary registry
>>> information or message DLL files to display messages from a remote
>>> computer. You may be able to use the /AUXSOURCE= flag to retrieve this
>>> description; see Help and Support for details. The following information
>>> is part of the event: Filen E:\Program
>>> Files\Exchsrvr\MDBDATA\E00.log\image01111.jpg inneh�ller Exploit-QtPICT
>>> '_'. Ingen rensningsfunktion finns tillg�nglig s� filen har ist�llet
>>> tagits bort. Uppt�ckt med genoms�kningsmotor version 5300.2777
>>> DAT-version 5472.0000..
>>> (Some of the text Is swedish because of the fact we are using a swedish
>>> language fil to our McAfee Virusscan Enterpise)
>>>
>>> * I have restored the E00.log file from the qurantine and restarted the
>>> IS but with out success.
>>> * I have used and followed a link
>>> http://www.petri.co.il/mount_exchange_database_when_e00log_is_missing.htm
>>> with out success.
>>> * I followed and installed the KB from
>>> http://www.microsoft.com/downloads/thankyou.aspx?familyId=2a835a09-8e57-4027-a488-1e61c4b43a10&displayLang=en
>>> KB930241
>>> * Usually the virusprotections i sexcluded from scanning exchange DB and
>>> log locations but in my case i missed to add a new added disk in vmware
>>> to the excklusions list and i, after the add, moved the exchange logg
>>> files to that disk. I have followed
>>> http://support.microsoft.com/?kbid=245822 when excluding files and
>>> folders related to Exchange.
>>>
>>> Exchange BPA doesnt hit down on anything at all, all issues in BPA were
>>> fixed during this summer and no new issues were found today.
>>>
>>> Attached is a part of the app log file i xls (csv comma delimeted).
>>> As of now I can start IS but not access the mailserver and the app log
>>> gets 9175 errors each time the IS is started up after resatrt of
>>> services.
>>>
>>> During the writing of this thread I have been restoring the Exchange IS
>>> from the latest backup to a Recovery Storage group In case I dont get
>>> the current one working.
>>> This Is not what I prefer due to emails recieved since latest backup.
>>>
>>> I need help to get my Exchange back online and would appreciate any
>>> assistans very much.
>>>
>>> Regards and many thanks In advance
>>>
>>> P:s This system Is not an SBS D.s
>>>
>>> //Henrik (Hear), MCP-SBS,
>>>
>>>
>>
>
>


 | 
Pages: 1
Prev: ActiveSync help
Next: Exchange 2007 Queue