XADM: The Information Store Does Not Start After You Apply SP1 or SP2 on a Server That Runs Symantec Norton AntiVirus (312428)


The information in this article applies to:

  • Microsoft Exchange 2000 Server
This article was previously published under Q312428
Important This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, take any appropriate additional steps to help protect your system.
Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
Note An antivirus program is designed to help protect your computer from viruses. You must not download or open files from sources that you do not trust, visit Web sites that you do not trust, or open e-mail attachments when your antivirus program is disabled.

For additional information about computer viruses, click the following article number to view the article in the Microsoft Knowledge Base:

129972Computer viruses: description, prevention, and recovery

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

When you apply Service Pack 1 (SP1) or Service Pack 2 (SP2) to an Exchange 2000 Server that runs Symantec Norton AntiVirus for Microsoft Exchange, the information store may not start. Event Viewer may show the following information in the Application log:
Event ID: 7031
Source: Service Control Manager
Description: The Microsoft Exchange Information Store service terminated unexpectedly. It has done this n time(s). The following corrective action will be taken in 1 milliseconds: No Action.

CAUSE

This issue can occur if Symantec Norton AntiVirus for Microsoft Exchange is installed on the Exchange 2000 Server when you apply SP1 or SP2.

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this issue, completely remove the antivirus program, including a specific key in the registry, and then reapply SP1 or SP2.

You can reinstall the antivirus program after you apply the service pack. Make sure that you install the version of the antivirus program that is specifically intended for the version of the service pack that you apply.

To completely remove the antivirus program, follow these steps:
  1. Under Services in the Microsoft Management Console (MMC), disable the System Attendant.
  2. Start the Add/Remove Programs tool in Control Panel, and then uninstall the Norton AntiVirus program. Note that you must actually uninstall the software for the program, not just disable the program.
  3. Delete the registry key that loads the API that the Norton AntiVirus program uses:
    1. Start Registry Editor (Regedit.exe).
    2. Locate the following key in the registry:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan

    3. On the Registry menu, click Export Registry File, type a name for the key, and then click Save.
    4. Right-click the key, and then click Delete.
    5. Quit Registry Editor.
  4. Restart the computer that is running Exchange 2000 Server.
  5. Start the Services MMC, and then set the startup mode for the System Attendant to Automatic.
  6. Reapply SP1 or SP2, and then restart the Exchange 2000 Server after successful installation of the service pack.
  7. If you reinstall the Norton AntiVirus program, make sure that you are installing the version that is specifically intended for use with the service pack that you applied.
Modification Type:MinorLast Reviewed:4/21/2005
Keywords:kb3rdparty kbenv kbprb kbSECAntiVirus kbSecurity KB312428
©2004 Microsoft Corporation. All rights reserved.