Observing scan error for .exe , msi, .dll files with a hex code 0x80800c00 in Symantec Protection Engine 8.2.1

book

Article ID: 221957

calendar_today

Updated On:

Products

Protection Engine for NAS

Issue/Introduction

Observing the scan error for .exe , msi, .dll and other executable files.

Error message : Failed with scan error hex code 0x80800c00 Client IP : x.x.x.x

ICAP SERVER RETURED ERROR CODE 500.

Cause

This error is typically seen for file insight related issues.
If there is any network issue or proxy causing the connectivity issues to Reputation servers.
For more information on Networking Port Requirements for SPE, please Click here

Insight is only applicable to PE files so this error appears only for .exe, .msi etc type of PE files.

Environment

Release : Symantec Protection Engine 8.2.1

Resolution

Correcting the connectivity to Symantec Reputation server resolves the issue.

If SPE Server is not connected to internet, you may disable the Insight scanning from Policy.xml to resolve the issue.

To Disable Symantec Insight™ in Symantec Protection Engine using xmlmodifier tool

  • Open cmd
  • Go to the Symantec Protection Engine installation directory.
  • Type the following Command and enter:
    .\xmlmodifier -s //policies/ThreatPolicies/InsightScanning/@enabled false policy.xml
  • Restart SPE service

If errors appear for any other type of file (non PE File) or does not get resolved by the resolution provided above, enable SPE, CSAPI and Stargate logs and provide it to Technical Support Engineer on a case.

Note : Technologies requiring internet like file insight, mobile insight/APK Scanning may show such errors if there is any connection issue to Symantec reputation server.

Refer : Networking Port Requirements for SPE

Attachments