Author Topic: Exchange crashes after 4.8.1049 program update  (Read 41776 times)

0 Members and 1 Guest are viewing this topic.

kwg

  • Guest
Exchange crashes after 4.8.1049 program update
« on: December 05, 2008, 10:26:21 PM »
Ever since installing the 4.8.1049 program update for Avast Server Edition this morning, Exchange Server 2003 has been shutting down on its own. Thereafter, the Avast Exchange 2000/2003 provider shows that it is "waiting for a subsystem to start."

Rebooting the server corrects the problem for a while, but Exchange Server eventually shuts down again, one or two hours after the reboot.

Before the 4.8.1049 program update this morning, I have never experienced a similar problem with Avast or Exchange Server.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #1 on: December 05, 2008, 10:33:33 PM »
Hmm. Do you have any dump files that we could use to look into the problem?

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #2 on: December 05, 2008, 10:46:41 PM »
Specifically, the problem is with the Exchange Information Store service. The service does not actually stop, but restarting the service corrects the problem for a while.

While mail delivery is halted, an error similar to the following is recorded repeatedly in the Application log:

Event Type:   Error
Event Source:   MSExchangeTransport
Event Category:   Exchange Store Driver
Event ID:      348
Date:      12/5/2008
Time:      1:30:51 PM
User:      N/A
Computer:   SBS2003
Description:
A message could not be virus scanned - this operation will be retried later. Internet Message ID  <...> Error Code 0x0.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #3 on: December 05, 2008, 10:57:40 PM »
Can you please check the Antivirus category of the Windows Event Log as well? Does it contain any entries that may be related to this?

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #4 on: December 05, 2008, 11:00:31 PM »
BTW couldn't this be related?
http://support.microsoft.com/kb/843545

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #5 on: December 05, 2008, 11:07:43 PM »
There are no errors in the Antivirus log; only the usual 26923 warning events whenever a virus is detected.

However, just before the Exchange crash, this information event appears in the Application log, suggesting that Avast may now conflict with IMF:

Event Type:   Information
Event Source:   MSExchangeTransport
Event Category:   SMTP Protocol
Event ID:   7513
Date:      12/5/2008
Time:      10:18:39 AM
User:      N/A
Computer:   SBS2003
Description:
Microsoft Exchange Intelligent Message Filter was refreshed. Microsoft Exchange Intelligent Message Filter is now enabled. A refresh occurs when the SMTP service is  restarted or Microsoft Exchange Intelligent Message Filter is updated.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #6 on: December 05, 2008, 11:12:43 PM »
BTW couldn't this be related?
http://support.microsoft.com/kb/843545

I think this issue is unlikely to be related. To my knowledge, no one in this particular company would send a digitally signed message.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #7 on: December 05, 2008, 11:26:55 PM »
Can you please also check the file <avast>\data\log\selfdef.log? Does it exist? And if so, what does it contain (if it's non-empty)?
If at first you don't succeed, then skydiving's not for you.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #8 on: December 05, 2008, 11:41:09 PM »
Contents of selfdef.log:

Quote
12/5/2008 7:42:02 AM   Write access to file \Device\HarddiskVolume2\Program Files\Alwil Software\Avast4\DATA\PxyCache\index.dat denied. [C:\Program Files\Microsoft ISA Server\wspsrv.exe]
12/5/2008 8:11:09 AM   Write access to file \Device\HarddiskVolume2\Program Files\Alwil Software\Avast4\DATA\PxyCache\index.dat denied. [C:\Program Files\Microsoft ISA Server\wspsrv.exe]

The time 7:42:02 AM corresponds to when the 4.8.1049 program update was installed.

The time 8:11:09 AM corresponds to when I rebooted the sever a second time after installation. The second reboot was necessary because the Exchange 2000/2003 provider was not active ("waiting for a subsystem to start") after the initial reboot requested by the program update.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #9 on: December 05, 2008, 11:48:16 PM »
Can you please try disabling avast self-defense and see if it makes any difference re Exchange stability?

avast settings -> Troubleshooting page.

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #10 on: December 05, 2008, 11:52:28 PM »
Can you please try disabling avast self-defense and see if it makes any difference re Exchange stability?

avast settings -> Troubleshooting page.

Done!

I'll update this thread with a report about Exchange stability over the next few hours.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #11 on: December 06, 2008, 06:40:12 PM »
Hi kwg,

do you have any updates for us?
How's it going with the self-defense module disabled?

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #12 on: December 06, 2008, 07:20:20 PM »
Unfortunately, the problem has recurred. Again, the problem seems to be associated with IMF.

Here's the first entry in the Application log:

Quote
Event Type:   Information
Event Source:   MSExchangeTransport
Event Category:   SMTP Protocol
Event ID:   7513
Date:      12/5/2008
Time:      6:24:47 PM
User:      N/A
Computer:   SBS2003
Description:
Microsoft Exchange Intelligent Message Filter was refreshed. Microsoft Exchange Intelligent Message Filter is now enabled. A refresh occurs when the SMTP service is  restarted or Microsoft Exchange Intelligent Message Filter is updated.

One minute later:

Quote
Event Type:   Error
Event Source:   MSExchangeTransport
Event Category:   Exchange Store Driver
Event ID:   348
Date:      12/5/2008
Time:      6:25:44 PM
User:      N/A
Computer:   SBS2003
Description:
A message could not be virus scanned - this operation will be retried later. Internet Message ID  <...>, Error Code 0x0.

Restarting the Microsoft Exchange Information Store service restores mail delivery and causes the Avast Exchange 2000/2003 provider to restart.
« Last Edit: December 06, 2008, 07:59:30 PM by kwg »

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #13 on: December 06, 2008, 08:13:23 PM »
If you look e.g. in the Antivirus event log, and compare the timestamps, can't the problem be e.g. related to a positive detection?

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #14 on: December 06, 2008, 09:24:26 PM »
It gets complicated here.

Ordinarily, Avast detects several viruses each minute. However, Avast seems to have stopped detection completely for 18 hours. Detection was restored only when I restarted the Microsoft Exchange Information Store service this morning.

Here is the last Antivirus log entry before detection stopped:

Quote
Event Type:   Warning
Event Source:   avast!
Event Category:   (12)
Event ID:   26923
Date:      12/5/2008
Time:      2:02:56 PM
User:      N/A
Computer:   SBS2003
Description:
VSAPI: A virus was found in message body part Full_Details.htm. The message will be processed according to the user-defined rules.

Message info:
Server: SBS2003
Database: First Storage Group\Mailbox Store (SBS2003)
Mailbox: ...
Folder: /Junk E-mail
Message: /Junk E-mail/ Earn $250 per day just for clicking your mouse with ClickedCash.EML
From: ClickedCash <clickedcash2@gmail.com>
To: ...
CC:  <>
Subject:  Earn $250 per day just for clicking your mouse with ClickedCash

Here is the first Antivirus log entry after I restarted the Microsoft Exchange Information Store service today:

Quote
Event Type:   Warning
Event Source:   avast!
Event Category:   (12)
Event ID:   26923
Date:      12/6/2008
Time:      10:37:29 AM
User:      N/A
Computer:   SBS2003
Description:
VSAPI: A virus was found in message body part Update-KB3125-x86.zip. The message will be processed according to the user-defined rules.

Message info:
Server: SBS2003
Database: First Storage Group\Mailbox Store (SBS2003)
Mailbox: ...
Folder: /Inbox
Message: /Inbox/Mail server report.-5.EML
From: serv@logoluso.com <serv@logoluso.com>
To: ...
CC:  <>
Subject: Mail server report.