Event 9874 is logged frequently after you install Exchange Server 2007 Service Pack 1

This article has been archived. It is offered "as is" and will no longer be updated.
After you install Microsoft Exchange Server 2007 Service Pack 1 on a computer that is running Exchange Server 2007, an event that resembles the following is logged frequently in the Application log:
Event ID : 9874 Category: None Source: MSExchangeIS Type: Warning Message: Unexpected error 0x50a occurred in "EcProcessVirusScanQueueItem" during virus scanning. Mailbox Database: <LegacyExchangeDN of the mailbox store> Folder ID: <folder ID> Message ID: <message ID>.
This problem may also affect server performance if the server is operating under a heavy workload. A heavy workload is a situation in which there are too many threads or a situation in which the CPU usage is much higher than expected.
Exchange Server 2007 Service Pack 1 introduces event 9874 to help with troubleshooting. When Virus Scan API (VSAPI) reports an issue at any diagnostic logging level, this event is logged so that users can trace the reason why an embedded message has a different signature than the top-level message. However, this event may also be logged when two threads try to obtain the same message.
To resolve this problem, install Update Rollup 7 for Exchange 2007 Service Pack 1. For more information about how to obtain this update, see the following Microsoft Knowledge Base article:
960384 Description of Update Rollup 7 for Exchange Server 2007 Service Pack 1

Note After you install this update, Exchange Server 2007 logs Event 9874 only when the diagnostic logging level of the MSExchangeIS\9002 System\Virus Scanning process is set to "high" or to "expert." Therefore, you stop receiving the unnecessary warnings and still receive all the necessary warnings.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Article ID: 967081 - Last Review: 01/15/2015 16:36:13 - Revision: 1.2

  • Microsoft Exchange Server 2007 Service Pack 1
  • kbnosurvey kbarchive kbsurveynew kbqfe atdownload kbexpertiseinter KB967081