Author Topic: Exchange crashes after 4.8.1049 program update  (Read 41962 times)

0 Members and 1 Guest are viewing this topic.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #15 on: December 07, 2008, 05:16:17 AM »
The problem continues, and the pattern is the same.

First a refresh of IMF:

Quote
Event Type:   Information
Event Source:   MSExchangeTransport
Event Category:   SMTP Protocol
Event ID:   7513
Date:      12/6/2008
Time:      12:35:30 PM
User:      N/A
Computer:   SBS2003
Description:
Microsoft Exchange Intelligent Message Filter was refreshed. Microsoft Exchange Intelligent Message Filter is now enabled. A refresh occurs when the SMTP service is  restarted or Microsoft Exchange Intelligent Message Filter is updated.

Then a failure of Avast;

Quote
Event Type:   Error
Event Source:   MSExchangeTransport
Event Category:   Exchange Store Driver
Event ID:   348
Date:      12/6/2008
Time:      12:45:28 PM
User:      N/A
Computer:   SBS2003
Description:
A message could not be virus scanned - this operation will be retried later. Internet Message ID <...>, Error Code 0x0.

Restarting the Microsoft Exchange Information Store service corrects the problem temporarily.
« Last Edit: December 07, 2008, 05:21:08 AM by kwg »

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #16 on: December 08, 2008, 06:26:47 PM »
Update: The problem continues exactly as described above.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #17 on: December 08, 2008, 09:46:27 PM »
In addition, I sometimes see these messages in the Application log soon before mail delivery stops and the Avast Exchange provider becomes disabled:

Quote
Event Type:   Error
Event Source:   Application Error
Event Category:   (100)
Event ID:   1000
Date:      12/8/2008
Time:      9:14:21 AM
User:      N/A
Computer:   SBS2003
Description:
Faulting application store.exe, version 6.5.7653.38, faulting module AvExVxx2.dll, version 4.8.1296.0, fault address 0x00005b7e.

Quote
Event Type:   Information
Event Source:   Application Error
Event Category:   (100)
Event ID:   1004
Date:      12/8/2008
Time:      12:18:26 PM
User:      N/A
Computer:   SBS2003
Description:
Reporting queued error: faulting application store.exe, version 6.5.7653.38, faulting module AvExVxx2.dll, version 4.8.1296.0, fault address 0x00005b7e.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #18 on: December 09, 2008, 01:12:35 PM »
Update: It is now Day 5 with this problem. Still no resolution.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #19 on: December 09, 2008, 04:17:59 PM »
Please check your email. Thanks.
If at first you don't succeed, then skydiving's not for you.

DavidCookson

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #20 on: December 09, 2008, 06:21:39 PM »
I am having exactly the same problem. Does anyone have a fix ?

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #21 on: December 09, 2008, 08:13:14 PM »
I am having exactly the same problem. Does anyone have a fix ?

Awil has written a fix, which I am currently testing for them. So far, so good.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #22 on: December 09, 2008, 10:32:48 PM »
David, are you also getting the "Microsoft Exchange Intelligent Message Filter was refreshed" message just before the problem starts taking place?

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #23 on: December 10, 2008, 09:38:49 AM »
Vlk,

Here's a very interesting observation:

1. IMF updates are issued by Microsoft only two times per month.

2. Before the Avast 4.8.1049 upgrade, the ID 7513 events occurred only a few times each month.

3. After the Avast 4.8.1049 upgrade, the ID 7513 events are occurring every two hours almost exactly (plus or minus a few minutes each time).

I suspect, therefore, that Avast 4.8.1049 is somehow causing the ID 7513 events every two hours, perhaps by restarting the SMTP service. In other words, the ID 7513 events are a symptom of a problem in Avast which occurs every two hours, not the cause of the problem.

What does Avast do every two hours, plus or minus a few minutes? Does Avast attempt a VPS update? Is the SMTP service involved?

dewib

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #24 on: December 10, 2008, 11:59:20 AM »
I'm experiencing the same problem. Running a SBS2003. Since the Avast update, Exchange hangs up with error code 348: "A message could not be virus scanned - this operation will be retried later. Internet Message ID  <...>"

As kwg wrote, restarting the Exchange Information Store service helps for a while.

But here seems no correlation to event ID 7513. I have no 7513 entries in the logs. But ID 9661 which says "standard filtering level for unrequested commercial e-mail has been updated. The new value is 8." (sorry for translation, I have German language event logs ;))

Is there a fix available, yet?

DPNC

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #25 on: December 10, 2008, 03:05:40 PM »
I have the same problem after update from 4.7 to 4.8. Server 2003 with Exchange server 2003 SP2.
I've just deinstalled AVAST and now for 3 hours no problems, otherwise I had to restart Information Store and AVAST engine every 2 hours. I will reinstall when a fix is availlable.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Exchange crashes after 4.8.1049 program update
« Reply #26 on: December 10, 2008, 06:27:15 PM »
Guys,

it would be helpful if you could create a dump of the store.exe process at the moment the problem is simulated.
To do this, please download http://public.avast.com/~vlk/userdump.exe

Once the problem is simulated, run

userdump store.exe c:\store.dmp

This will create a file store.dmp in C:\ (a memory dump of the Exchange IS process). Zip it and upload it to ftp://ftp.avast.com/incoming (please note that you won't have READ access to the ftp site, just WRITE).


Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

kwg

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #27 on: December 11, 2008, 07:51:59 AM »
I did send Vlk a dump created just 5 seconds after the event occurred. Since the dump is half a gigabyte in size, and the Avast "Incoming" directory is write-only, I don't know yet whether my upload was successful.
« Last Edit: December 11, 2008, 07:55:40 AM by kwg »

olt

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #28 on: December 11, 2008, 10:40:36 AM »
We are now also seeing this problem on 2 customers' servers.  It's very bad.  Has anyone tried turning off IMF to see if that helps?

Regards,
Edmund

akiehtr

  • Guest
Re: Exchange crashes after 4.8.1049 program update
« Reply #29 on: December 11, 2008, 02:50:19 PM »
Hello!

This one is a massive problem!!!!

I have got 12 (twelve!!!!) customers out there which cannot receive mails since the update - same error as mentioned above.

What i have already tried:
- restart services: no effect
- uninstall avast scanner & reboot: mails can be received again - but no virus scanning of course
- reinstall avast server edition (SBS & standard versions): works for about 3 hours - then same error again
- deactivated IMF & restarted services: works for 4-5 mails; then crashes again

So currently, only UNINSTALLING avast scanner brings back a functional solution -
we REALLY need a patch on this !!!!