During manual, scheduled or realtime scanning, Symantec Mail Security for Microsoft Exchange experiences multiple process crashes. In the Windows Application event log, the sequence of events starts with multiple event ID 45s indicating Scan engine failures while scanning different items, followed by Event ID 167 indicating the SAVFMSECtrl.exe process terminated unexpectedly. This may also be accompanied by event ID 218s showing files as unscannable.
When the size of the recipients field exceeds the memory buffer allocated for scanning, the SAVFMSECtrl.exe (controller) process crashes, which causes the SAVFMSESp.exe (scanner process) processes to be terminated by the new instance of the controller process that is spawned, and all items being processed at the time are marked as unscannable.
A patch has been created to prevent this issue from occurring. Apply the attached patch to prevent these crashes.