Trying to understand Event ID 1000 error for Exchange server

I'm tyring to figure out what this error is referring to -and more importantly- how to resolve it if it is a serious issue.
It has happened only once (last night).  Everything is online at this point... but I'd like to know what this is regarding so I can ascertain how much I should worry.
(Exchange 2003 w SP2 on Server 2003)

Event Type:      Error
Event Source:      Microsoft Exchange Server
Event Category:      None
Event ID:      1000
Date:            2/11/2008
Time:            2:00:40 AM
User:            N/A
Computer:      CYGNUS
Description:
Faulting application exsp.dll, version 6.5.7638.1, stamp 430e735b, faulting module mimefilt.dll, version 6.0.3790.1830, stamp 424377cc, debug? 0, fault address 0x00002a21.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00   A.p.p.l.
0008: 69 00 63 00 61 00 74 00   i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00   i.o.n. .
0018: 46 00 61 00 69 00 6c 00   F.a.i.l.
0020: 75 00 72 00 65 00 20 00   u.r.e. .
0028: 20 00 65 00 78 00 73 00    .e.x.s.
0030: 70 00 2e 00 64 00 6c 00   p...d.l.
0038: 6c 00 20 00 36 00 2e 00   l. .6...
0040: 35 00 2e 00 37 00 36 00   5...7.6.
0048: 33 00 38 00 2e 00 31 00   3.8...1.
0050: 20 00 34 00 33 00 30 00    .4.3.0.
0058: 65 00 37 00 33 00 35 00   e.7.3.5.
0060: 62 00 20 00 69 00 6e 00   b. .i.n.
0068: 20 00 6d 00 69 00 6d 00    .m.i.m.
0070: 65 00 66 00 69 00 6c 00   e.f.i.l.
0078: 74 00 2e 00 64 00 6c 00   t...d.l.
0080: 6c 00 20 00 36 00 2e 00   l. .6...
0088: 30 00 2e 00 33 00 37 00   0...3.7.
0090: 39 00 30 00 2e 00 31 00   9.0...1.
0098: 38 00 33 00 30 00 20 00   8.3.0. .
00a0: 34 00 32 00 34 00 33 00   4.2.4.3.
00a8: 37 00 37 00 63 00 63 00   7.7.c.c.
00b0: 20 00 66 00 44 00 65 00    .f.D.e.
00b8: 62 00 75 00 67 00 20 00   b.u.g. .
00c0: 30 00 20 00 61 00 74 00   0. .a.t.
00c8: 20 00 6f 00 66 00 66 00    .o.f.f.
00d0: 73 00 65 00 74 00 20 00   s.e.t. .
00d8: 30 00 30 00 30 00 30 00   0.0.0.0.
00e0: 32 00 61 00 32 00 31 00   2.a.2.1.
00e8: 0d 00 0a 00               ....    
wasabikevAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sekhar_kiitCommented:
According to Microsoft:
CAUSE:
This problem may occur when there is a malformed e-mail message or other malformed item in the information store. Additionally, the processing of parameters in a HTML close tag may cause the Microsoft Exchange Information Store service to crash.
RESOLUTION:
A supported hotfix is now available from Microsoft, but it is only intended to correct the problem. Only apply it to systems that are experiencing this specific problem. You must stop and then restart the Microsoft Exchange Information Store service when you install this hotfix. You should install the hotfix on the front-end servers first, and then install the hotfix on the back-end servers.
But according to my suggestion do not install the hotfix if it is not causing serious problem. Better update your exchange server to the latest windows service pack available.
0
wasabikevAuthor Commented:
That's... really interesting on several fronts.

A malformed email or other item sent through the Exchange Information Store can cause the entire service to crash?  That's really not good news if true.  Is the malform a randomized corruption, or is it by design?  And if it can happen via random circumstances, are those circumstances easily reproduceable? In which case it could be done via design...  (ugh).  I'm not an uber-Exchange admin, but methinks you've just indicated a potential exploit....

Your input is deeply interesting whlie being quite disconcering at the same time.  Given the ramifications, I would greatly appriciate sources for additional study and verification of this hypothesis.  (KB article or other?)  Thanks for you time.
0
sekhar_kiitCommented:
Did you enable Full Text Indexing on the exchange server? I did not get the exact kb for this error, but still check for the following which may help to get some knowledge.
http://support.microsoft.com/default.aspx?scid=kb;en-us;827214
http://forums.techarena.in/showthread.php?t=833975 

As the exsp.dll is an exchange component, I think re-applying Exchange SP2 on the server should resolve the issue.
0
wasabikevAuthor Commented:
Full Text Indexting is not enabled on the server.
However, a few clients do have Desktop Search installed.

I had previously found references to the same type of error
"Faulting application exsp.dll, version 6.5.7638.1, stamp 430e735b,
faulting module offfilt.dll, version 2002.10.4.0"
This is close... but the issue here involves mimefilt.dll, not Offfilt.dll.  That said, I have also found this KB: http://support.microsoft.com/kb/915800 which indicates an issue and hotflx related to Offffilt.dll and Mimefilt.dll.  Alas- the versions of the files indicated in this KB article do not quite match.  

Overall it looks like this may be related to Desktop Search.  This issue has not reoccured since the original post, but Desktop Search will get installed on more systems soon.  If it is related to the clients getting desktop search installed, I'll know it soon enough.
0
wasabikevAuthor Commented:
I'm not sure how to close this one...  the issue has not reoccured, and the potential solutions above never did quite fit the issue.

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.