Mail Security for Microsoft Exchange 7.9.x experiences multiple process crashes

book

Article ID: 184844

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

During manual, scheduled or realtime scanning, Symantec Mail Security for Microsoft Exchange experiences multiple process crashes. In the Windows Application event log, the sequence of events starts with multiple event ID 45s indicating Scan engine failures while scanning different items, followed by Event ID 167 indicating the SAVFMSECtrl.exe process terminated unexpectedly. This may also be accompanied by event ID 218s showing files as unscannable.

Type : Warning
Event : 45
Source : Symantec Mail Security for Microsoft Exchange
Category : Unscannable
Description:
Scan Engine Failure.
HRESULT = 0x80004005.  This error occurred while scanning the attachment "<attachment name>" of message "<subject>" located in "<mailbox>".

 
Type : Error
Event : 167
Source : Symantec Mail Security for Microsoft Exchange
Category : Service
Description:
The process SAVFMSECtrl.EXE terminated unexpectedly

 
Type : Warning
Event : 168
Source : Symantec Mail Security for Microsoft Exchange
Category : Service
Description:
The process SAVFMSECtrl.EXE was restarted.
 
Type : Warning
Event : 218
Source : Symantec Mail Security for Microsoft Exchange
Category : Unscannable
Description:
The attachment "<attachment name>" located in message with subject "<subject>", located in SMTP has violated the following policy settings:
Scan: Auto-Protect
Rule: Unscannable File Rule
The following actions were taken on it:
The attachment "<attachment name>" was <action> for the following reason(s):
Timeout occurred while scanning this item
For more information, visit https://entced.symantec.com/entt?product=SMSMSE&build=symantec_ent&version=7.9.1.51&language=english&module=event_logging&error=218 .

Cause

When the size of the recipients field exceeds the memory buffer allocated for scanning, the SAVFMSECtrl.exe (controller) process crashes, which causes the SAVFMSESp.exe (scanner process) processes to be terminated by the new instance of the controller process that is spawned, and all items being processed at the time are marked as unscannable.

Resolution

A patch has been created to prevent this issue from occurring. Apply the attached patch to prevent these crashes.

 

Attachments

1607033764620__4262519_HF.zip get_app