Information Store unavailable but IS is running

I had to reboot four of our Exchange servers this morning because noone could connect to mail.  They all showed the same symptoms.  The IS was running but inaccessible from System Manager, which gave and event id of c1041721.  Last night we saw a Dr. Watson error in the app log.  Event ID 4097 regarding svchost.exe.  Since that error, we received an error generated by the SA every five minutes, indicating that the MAD monitoring thread was unable to connect to WMI...

Incidentally, we are running Symantect Antivirus for Exchange and have been deleting a large number of viruses...

Does anyone have any idea what might have happened.  So far the reboot has fixed it, but any recurrence of this issue will be a major problem

Thanks,
Luke
ltimothyAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

kevalaCommented:
You need to apply the security patch for MS03-026

MS03-026: Buffer Overrun in RPC May Allow Code Execution
http://support.microsoft.com/?id=823980

You need to get this patch on ALL machines ASAP!!

This is the RPC vulnerability that the MSBlaster virus was taking advantage of. I have seen your exact issue 100 times now.

The RPC vulnerability is allowing the attacker to utilize port 135 and kill the svchost (RPC) service, which then terminates any use of the Event Viewer, Services, MAPI connectivity, etc. etc.

Get this patch on all machines ASAP, then run the MSBlaster removal tool on all machines to ensure the virus is not actually sitting somewhere.

You can get the removal tool for free from just about any AV website....

Once you get this patch applied and the removal tool run, you will be good to go!

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.