Symantec Mail Security for Microsoft Exchange (SMSMSE) has trouble loading new virus definitions. Issues may include mail flow slowdowns or stopping and event ID 110, 167, 168 and 68 being written to the application event log.
Symptoms will be identical to those described in this document:'The Exchange server is beeping, and / or you are getting the following SMSMSE events: 110, 168, 68, and 167, in Windows Application Event log.'
When SMSMSE receives a new virus definition set it tries to load them. If SMSMSE is unable to use the new virus definition set then it attempts to roll back to a previous version of the virus definitions. SMSMSE is unable to roll back and this issue occurs. The roll back functionality is not functioning as expected.
This problem is fixed in Symantec Mail Security 6.5.1 for Microsoft Exchange. To download the latest release, read Obtaining an update or an upgrade for a Symantec Corporate product.
NOTE: All file paths will be in Program Files (x86) on 64 bit systems
Run Rapid Release definitions in SMSMSE.
Stop the SMSMSE service
Clear the existing definitions from SMSMSE to allow SMSMSE to process new definitions
NOTE: The latest definition folder can be found in
For example, copy all files from C:\Program Files\Common Files\Symantec Shared\VirusDefs\2010XXXX.XXX to C:\Program Files\Common Files\Symantec Shared\definitions\Antivirus\incoming.
Start the SMSMSE service
When the service starts up, SMSMSE will read the definition files from the incoming folder and create a new virus definition folder under the Antivirus folder. For example, a folder, A VirusDefs00000001 is created in C:\Program Files\Common Files\Symantec Shared\definitions\Antivirus.