Event ID 9874 is frequently logged on Exchange Server 2007 with Service Pack 1

After you install Service Pack 1 for Exchange Server 2007, you may see that events that are similar to the following are frequently logged in the Application log:

Event ID : 9874
Category: None
Source: MSExchangeIS
Type: Warning
Message:
Unexpected error 0x50a occurred in "EcProcessVirusScanQueueItem" during virus scanning. Mailbox Database: <LegacyExchangeDN of the mailbox store> Folder ID: <folder ID> Message ID: <message ID>.

After you install Service Pack 1 for Exchange Server 2007, the event is logged when the the Virus Scan API (VSAPI) scanning reports an issue in any diagnostics logging level. This event is logged so that users can trace the reason why an embedded message has a different signature than the top level message. However, this event can also be logged when two threads try to pick up the same message, which is harmless.

To resolve this problem, install Update Rollup 7 for Exchange 2007 Service Pack 1. For more information about Update Rollup 7 for Exchange Server 2007 Service Pack 1, see the following Exchange Help topic: For more information about how to obtain the latest Exchange service pack or update rollup, see the following Exchange Help topic:

Note After you install this hotfix, Exchange Server 2007 logs the event only when the system diagnostics logging level in the �MSExchangeIS\9002 System\Virus Scanning� path is set to "high" or to "expert." Therefore, you can stop receiving the unnecessary warnings and still receive all necessary warnings.

For more information about how to change logging levels for Exchange processes, visit the following Web site:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.