Sharepoint intermittently reports file uploads as viruses when disk exhausted on filesystem where SPE scanner is installed

Products

• Protection for SharePoint Servers

Issue/Introduction

When uploading or downloading a file to SharePoint protected by Symantec Protection for SharePoint Services (SPSS), SharePoint displays a dialog box containing the text:

Virus Found

If you want to open this file, you'll need to clean the file using your own scanning software. This seems to be occurring with PDF files.

 

On the list of scanners for any single SharePoint server within SPSS, one or more instances of Symantec Protection Engine (SPE) has the status of Offline.

 

Environment

Release : SPSS 6.1.2 + SPE 8.2.2

Resolution

1. Remove the OFFLINE SPE instance from each of the lists of SPE scanners
2. Upload the same files which caused SharePoint to display a virus dialog box.
3. If SharePoint allows upload of the same files without displaying the Virus Found dialog box, the issue is related to the stability on the individual SPE instances.
4. If the individual SPE scanners are offline, try restarting the "Symantec Protection Engine" service in services.msc on those servers, leave the impacted SPE instance listed on a single SharePoint server list of scanners, and monitor.

 

Additional Information

NOTE: In the Application Log of Windows Event Viewer, critical events from a source of SharePoint Foundation tend to show causes for SharePoint itself to be unstable, which may also de-stabilize SPSS or SPE. Event 1053 may show failed attempts to start the SPSS or SPE instances.