XADM: Information Store Service Does Not Start, Event IDs 9581 and 9564 (319754)

Important This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, take any appropriate additional steps to help protect your system.
Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
Note An antivirus program is designed to help protect your computer from viruses. You must not download or open files from sources that you do not trust, visit Web sites that you do not trust, or open e-mail attachments when your antivirus program is disabled.

For additional information about computer viruses, click the following article number to view the article in the Microsoft Knowledge Base:

129972Computer viruses: description, prevention, and recovery

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

When you restart your Microsoft Exchange 2000 Server-based computer, the Microsoft Exchange Information Store service may not start. The following events may be displayed in the Event Viewer:

Date: <date>     Source:   MSExchangeIS
Time: <time>     Category: (40)
Type: Error      Event ID: 9581
User: N/A
Computer: <ComputerName>

Description:
The description for Event ID ( 9581 ) in Source ( MSExchangeIS ) cannot be
found. The local computer may not have the necessary registry information
or message DLL files to display messages from a remote computer. The 
following information is part of the event: -1.

-and-

Date: <date>     Source:   MSExchangeIS
Time: <time>     Category: General
Type: Error      Event ID: 9564
User: N/A
Computer: <ComputerName>


Description:

The description for Event ID ( 9564 ) in Source ( MSExchangeIS ) cannot be
found. The local computer may not have the necessary registry information
or message DLL files to display messages from a remote computer. The
following information is part of the event: 0xffffffff, Failed to init
VSERVER.

NOTE: If you have McAfee GroupShield installed, the following event may be displayed in the Event Viewer.

Date: <date>     Source:   GSEVS
Time: <time>     Category: None
Type: Error      Event ID: 1067
User: N/A
Computer: <ComputerName>

Description:
The description for Event ID ( 1067 ) in Source ( GSEVS ) cannot be found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. The following
information is part of the event: .

CAUSE

This behavior may occur when you have an antivirus program installed and the antivirus program is damaged. This may occur for one or more of the following reasons:

You reinstall or restore Exchange 2000 Server from backup, but you do not reinstall the antivirus program.
You remove the antivirus program, but the removal of the program is incomplete or damaged.

You may also experience this behavior if you install an Exchange 2000 Server service pack that is incompatible with the antivirus program.

RESOLUTION

To resolve this issue, use Registry Editor to turn off virus scanning, and then remove the antivirus program. To do this, follow these steps.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

Click Start, click Run, type regedit in the Open box, and then click OK.
Browse to the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan
On the Registry menu, click Export Registry File.
In the File name box, type virusscan, and then click Save.

NOTE: If you later need to restore this registry key, you can do so by double-clicking the Virusscan.reg file that you saved.
In the right pane of the Registry Editor window, right-click the Enabled value, and then click Modify.
In the Value data box, type 0 (zero), and then click OK.
Quit Registry Editor, and then restart the computer.
Remove the antivirus program.
Reinstall the Exchange 2000 Server service pack (if you previously installed a service pack).
Reinstall the antivirus program.

NOTE: Before you reinstall the antivirus program, contact the program vendor for possible updates or patches.For information about how to contact computer software vendors, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:
65416 Hardware and Software Third-Party Vendor Contact List, A-K

60781 Hardware and Software Third-Party Vendor Contact List, L-P

60782 Hardware and Software Third-Party Vendor Contact List, Q-Z

MORE INFORMATION

To obtain Service Pack 2 for Microsoft Exchange 2000 Server, visit the following Microsoft Web site:

http://www.microsoft.com/exchange/downloads/2000/sp2/default.asp

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.