https://support.eset.com/kb771

tegory: None
Source: MSExchangeIS
Type: Warning
Message: Unexpected error 0x50a occurred in EcProcessVirusScanQueueItem during virus scanning.
Mailbox Database: /o=LDS-EXCH/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=mbx05/cn=Microsoft Private MDB
Folder ID: 1-24
Message ID: 1-200B2C66C

NOTE: This problem relates to events that report error code 0x50a for messages in Folder FID: 1-24. Other error codes have a different root cause and should be investigated separately.

Event ID 9874 is new to SP1, and was introduced to help investigate failures of antivirus scanning engines – events reporting error code 0x50a are an incidental side effect. These events are false positives and do not indicate any problem with antivirus scanning engines. However, these events are related to the antivirus stamp expiration on embedded messages accessed with a WebDAV client.

Conditions for Event ID 9874 reporting 0x50a to be triggered:

• WebDAV client (e.g., Entourage – email client for Macintosh).
• Presence of any messages containing embedded messages in the user’s mailbox. If these messages were not accessed by a MAPI client since the antivirus program scanned them, Event ID 9874 may appear.
• Embedded messages were scanned a long time ago (before the last antivirus). Current stamp on the embedded message is not up to date.

Solution 1: Microsoft has scheduled a fix for inclusion in Service Pack 1 RollUp 2 for Exchange 2007, available for download here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=99da32e0-d9e3-4156-aabf-8369bf96e3e7&DisplayLang=en ?

Solution 2: Using Outlook Web Access or Outlook client, open all messages which have attachments. This should trigger a rescan of the embedded messages and stamp them with the current date, preventing Event ID 9874 from being logged.