Author Topic: Migration to Avast not succesfull (Exchange 2007)  (Read 21326 times)

0 Members and 1 Guest are viewing this topic.

mbraeken

  • Guest
Migration to Avast not succesfull (Exchange 2007)
« on: April 09, 2009, 11:28:17 PM »
Hello,

Tonight we had our migration to Avast scheduled and this for our entire server park...
Not everything went smoothly  :-\
We had 1 major incident related to our exchange 2007 server...

What preparational work was done:
An installation package was made on the ADNM with following providers/Plugin:

  • Network shield
  • Web shield
  • Standard shield
  • Script blocking
  • The Bat!

Plugin: Exchange 2007

After removing the previous AV solution and rebooting the server, the package was pushed from our ADNM to the exchange server.
After installation, the exchange services were stopped and the server was rebooted.

After reboot, the Outlook 2003 clients did not connect while the Avast netServer Client was running.
After some checking it seemed that the problem was the MS Exchange Information Store not running.
Impossible to start and any attempts to start it resulted in error code 0 0x0...

After some troubleshooting, we deinstalled the package that was pushed with the ADNM, rebooted the server and decided to install the standalone Server Edition package...

After the reboot the server booted with another new error message:

Exchange MDB encountered an issue and had to be closed.
The server was again rebooted. After reboot, the outlook clients seemed to connect, but it was impossible to send/receive mails...

During the install I setup my mail account to receive mails with the log entries... this resulted in 11000 mails in my inbox.

One of them: [MP-EXC01]: AAVM - scanning error: ClientRqDispatchThread: SessionID not found - global map corrupted??, 000017B6.

So at the end of the day, we came also to deinstall the standalone Avast Server Edition and ended up with no protection at all (our previous AV solution has been decommisioned entirely tonight)

Highly appreciated if someone could assist with this.

Cheers,
Mario

wpn

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #1 on: April 10, 2009, 11:55:29 AM »
i dont know why u have THE BAT in ur provider list, but its not needed on an exchange 2007 server....
see this thread for provider needed on an exchange server: http://forum.avast.com/index.php?topic=15452.0

did u check in the EVENTLOG from the exchange server why the service didnt start?

i noticed in my virtual test enviroment with a clean install that exchange was b*tching about an invalid AV sollution
(same problem here: http://forum.avast.com/index.php?topic=40960.0) although i obviously never installed another
av solution before on my clean test server.... (test server win2k8 64bit + exchange 2007 64bit, so production standards)

i did the registry setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled key to "0" like mentioned in the last posting i just gave u and i started the service again succesfull.
While running the exchange service i changed the setting to 1 again and i rebooted the server again and it did start succesfull now with the exchange scanner provider running....
Unfortuanately i cant test this right now anymore since i cleaned my test enviroment again, in the near future i will try it again tho

hopefully this is what u are looking for



mbraeken

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #2 on: April 10, 2009, 03:42:10 PM »
Hello wpn,

Thanks - I'm going to look into these references you gave.
I need to schedule again downtime to do testing/installation so I'll get back to you with my results...

Cheers,
Mario

mbraeken

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #3 on: April 10, 2009, 03:48:23 PM »
Wpn,

I have an additional question: is there some place where I can find documentation on the netServerClient/Avast Server Edition ?
I found good documents related to the Avast Professional client (enduser), but except for a one pager nothing usefull that could help build up some knowledge on settings etc...
The Bat! is something that I was still looking for to find some more details...

Cheers,
Mario

wpn

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #4 on: April 15, 2009, 12:34:53 AM »
i cant give u any documents with information since all information i have is from the forum here or figuring out in my VM's by just trying...
(admitted, i didnt read the manuals completely, just 1 time the ADNM manual partially to setup up ADNM for the very very first time)

i do however know that THE BAT is an email client ( i used it for a while but its not free ) which i assume in an exchange enviroment you will use outlook for becuz of the integration and the non-pop usage....

not to be rude here but 2 questions:
1) why migrate an entire server park (sounds big, but is it?) at once?
2) didnt you test this with a clean test setup and a copy of your production enviroment ?  (dont get me wrong i love experimenting, but not really on my production enviroment ;))

mbraeken

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #5 on: April 23, 2009, 05:34:06 PM »
Hello wpn,

To answer your 2 questions:
1. we have little opportunity to bring down our server park - so when we bring it down - we need to move forward with things hence the reason why we have migrated the full server park in one go.

2. Everything was tested first in a virtual server environment, so we tought we had everything tacled. Only 1 server in our server park failed so I would say that things went more or less OK.


Regarding the documentation:
I do not find it normal that there's no addititional information available, next to the onepager. It's not like am having nothing else to do then to surf the forum to find my answers. I think all companies that have a serious IT department, who have external audits, etc, are in need of these things. It's really unbelievable that they do not exist.

Tonight, I'm trying to migrate our exchange server again. Will come back and let you know how it went...
Thanks for your response !

Mario

mbraeken

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #6 on: April 23, 2009, 07:09:14 PM »
So here is the result of the migration to Avast for our Exchange 2007 server:

I have remotely deployed a netServer package.
Enabled providers are Network Shield and Web Shield and the Exchange 2007 additional feature. Only language selected is English.
This package was sent to the server and installed perfectly. I did not have Avast reboot the server. I first stopped all exchange services and then initiated manually a reboot...

When rebooted, the Avast app was running in the Systray, saying 3 providers, 2 running.
Our Outlook clients were unable to connect to the exchange server however.

Checking the same thing as last time: indeed - the exchange information store service did not come up...
Tried to start it: not possible - same error as last time...

Went into the registry: changed the suggested value to 0:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled

Tried again to start the MSExchangeIS service: within a couple of seconds the service was up and running and the Outlook clients could connect...

Went back into the registry, changed the value back to 1.

Stopped all exchange services and restarted the server: same scenario - Avast is OK, MSExchangeIS isn't - service is not running...

Same ritual: reg key back to 0, start service, reg key back to 1...

This obviously isn't working: next time our server is being patched with the latest Windows updates, it will be rebooted and mail services won't be functional after the reboot...

In the event viewer (system log), I find following message:

The Microsoft Exchange information Store service terminated with a service-specific error 0 (0x0).

That's all to be found in there...

Someone, anyone ?

Offline scythe944

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2913
    • My Tech Blog
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #7 on: April 23, 2009, 08:24:41 PM »
I had the same problem with an SBS 2008 server.  However, they come with forefront security installed, which caused problems such as this.

After removing all MS anti-virus software, avast and exchange started talking to each other properly.

Also, did you have any other (non-MS) anti-virus installed previously?  It could cause the problem as well.
For generic computer (not avast) problems, you can also visit my forum for help: http://www.jacobytech.net/forum

wpn

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #8 on: April 24, 2009, 09:41:44 AM »
Which OS are you using for the exchange box??

Windows 2008 server or windows 2003 server?

im gonna test this in a virtual enviroment again now cuz im positive it worked for me what i wrote, but that was on a clean install....

ill see if i can test a 2003 setup this weekend tho i only have the 32bit version of 2003 server (which is not a production supported version for exchange 2007)

i will let u know what happend

mbraeken

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #9 on: April 24, 2009, 10:11:58 AM »
Hey,

@scythe944:
We were running CA eTrust before, which was uninstalled. The box was fully restarted after the uninstallation.
The reg key, ...../VirusScan was not in the registry after the uninstallation of eTrust and prior to the installation of Avast.
It was only after the installation of Avast I could locate it and change the sub key "enabled" to "0" to startup the MS Exchange Information Store Service...

Can you think of any thing else (remainders of eTrust,...) that could be causing my issues ?

@wpn:
The OS is Windows Server 2003 R2 Enterprise x64 Edition with Service Pack 2
(the physical machine is a HP Proliant box - Intel Xeon CPU E5320 1.8 Ghz and 8Gb of RAM)

Thanks for your help in this. It's very much appreciated !!

P.S. Do you get email notifications when someone replies to a forum post ? I always have to come and look to see whether you guys have been online. Would be great to have somekind of a notification - I would be able to respond much quicker  ;D

Offline scythe944

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2913
    • My Tech Blog
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #10 on: April 25, 2009, 05:36:42 AM »
Quote
(remainders of eTrust,...) that could be causing my issues

Quite a possibility! Google etrust removal tool and see what you find. Many problems that are posted on this forum are due to remnant A/V programs.
For generic computer (not avast) problems, you can also visit my forum for help: http://www.jacobytech.net/forum

wpn

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #11 on: April 27, 2009, 11:07:02 PM »
i promised u to check out this stuff in the weekend but i got crowded, so i wanted to do it today (monday) but this afternoon my exchange server went down and i got it up at 17:00 and im still praying that nobody is sending bigger e-mail then 10kb a time so the server wont go down again..... so for now that has my priority, sorry
when i get time to test this i will test it

Offline scythe944

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2913
    • My Tech Blog
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #12 on: April 28, 2009, 03:20:38 AM »
Take your time bro, we'll be here. Well, hopefully!
For generic computer (not avast) problems, you can also visit my forum for help: http://www.jacobytech.net/forum

wpn

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #13 on: April 29, 2009, 12:22:01 AM »
im testing with this virtual setup:

win2k8 Ent DC 64bit
Win2k3 Ent R2 64bit
WinXP 32bit client for the avast software
i dont know whats wrong but my vm's are slow as h*ll at this moment
just installed avast, so ill let u know what will happen when i get it done with this speed

edit:

echange installation package:
avast server
network shield
web shield
standard shield
script blocking (this coudl be left out i guess)
exchange 2007 plugin


after reboot the store didnt come up
i changed the regkey to 0 and it came up
i changed the regkey to 1 again and restarted the service, but it failed to start

in the app. event viewer on the exchange server i get:
   Error code 1006 returned from virus scanner initialization routine. Virus scanner was not loaded.
   eventid: 9581
   source: MSExchangeIS
   category: Virusscanning
 and
  Error 0x3ee starting the Microsoft Exchange Information Store.
   Failed to init VSERVER.
  eventid: 9564
  source: MSExchangeIS
  category: General

in the sys event viewer on the exchange server i get:
  The Microsoft Exchange Information Store service terminated with service-specific error 0 (0x0).
  eventid: 7024
  source: Service Control Manager

in the avast event viewer on the exchange server i get:
  VSAPI: Avast has not started yet. Will keep waiting...
  eventid: 26921
  source: avast!
  category: (12)

this is done in a totally clean installation
so far my findings, im gonna test some more

hopefully Avast crew is reading this too so they can eithe come up with the solution (since a lot of people have the same problem) or a clear explanation on what cuold have been done wrong....




this is the text from MS when u click on the link in the event viewer details window
i post them one by one:

Quote

 
Details
Product: Exchange
ID: 9581
Source: MSExchangeIS
Version: 8.0
Symbolic Name: msgidVSErrorInitialize
Message: Error code %1 returned from virus scanner initialization routine. Virus scanner was not loaded.
   
Explanation
This Error event is typically logged for one of the following conditions:

When you are using antivirus software that is not compatible with Microsoft Exchange Server 2007.

When you have an antivirus program installed, and the antivirus program is damaged. An antivirus program can be damaged for one or more of the following reasons:

You reinstall or restore Exchange Server from backup, but you do not reinstall the antivirus program.

You remove the antivirus program, but the removal of the program is incomplete or damaged.

The error code provided in event 9581 may help you discover the underlying cause.

The Microsoft Exchange Information Store service (MSExchangeIS) Error event 9564 may be logged with event 9581. Event 9564 indicates that the Microsoft Exchange Information Store service was not able to start.
 
   
User Action
To resolve this error, try one or more of the following:

Make sure that the antivirus software you are using is compatible with Exchange 2007. Contact your antivirus vendor to determine which version of antivirus software is compatible with Exchange 2007. For details, see Microsoft Knowledge Base article 49500, List of antivirus software vendors.

Note   If you determine that the software you are using is not compatible with Exchange 2007, disable the antivirus software on the server, and then restart the Microsoft Exchange Information Store service.

Make sure that you have correctly removed any antivirus software that you currently are not using. Contact your antivirus vendor for information about how to correctly remove the antivirus program.

Make sure that you have correctly installed the antivirus software that you currently are using. Contact your antivirus vendor if you have any questions about correct installation of the antivirus program.

For a general overview of antivirus support in Exchange Server, see Microsoft Knowledge Base article 823166, Overview of Exchange Server 2003 and antivirus software.


Note  If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

 
   
   
Version: 6.5.7638.0
Component: Microsoft Exchange Information Store
Message: Error code <error code> returned from virus scanner initialization routine. Virus scanner was not loaded.
   
Explanation
This Error event is typically logged in one of the following conditions:

When you are using antivirus software that is not compatible with Exchange Server 2003.

When you have an antivirus program installed and the antivirus program is damaged. An antivirus program can be damaged for one or more of the following reasons:

You reinstall or restore Exchange Server from backup, but you do not reinstall the antivirus program.

You remove the antivirus program, but the removal of the program is incomplete or damaged.
Event 9581 may appear during upgrades from Exchange 2000 Server to Exchange Server 2003 or during the installation of Service Pack 2 on an Exchange 2000 server. The error code provided in event 9581 may help you discover the underlying cause. The two most common error codes seen in event 9581 are error code -2147221232 and Error code -1.

MSExchangeIS Error event 9564 may be logged with event 9581. Event 9564 indicates that the Microsoft Information Store Service was not able to start. Two of the common error codes seen in event 9564 are 0x80040110 and 0x3ee.
 
   
User Action
To resolve this issue, try one or more of the following:

Make sure that the antivirus software you are using is compatible with Exchange Server 2003. Contact your antivirus vendor to determine which version of antivirus software is compatible with Exchange Server 2003. For details, see Microsoft Knowledge Base article 49500, List of antivirus software vendors.
Note   If you determine that the software you are using is not compatible with Exchange Server 2003, disable the antivirus software on the server, and then restart the Information Store Service.

Make sure that you have correctly removed any antivirus software that you currently are not using. Contact your antivirus program vendor for information about how to correctly remove the antivirus program.

Make sure that you have correctly installed the antivirus software that you currently are using. Contact your antivirus program vendor if you have any questions about correct installation of the antivirus program.
For a general overview of antivirus support in Exchange Server 2003, see Microsoft Knowledge Base article 823166, Overview of Exchange Server 2003 and antivirus software.
 
   
   
Version: 6.5.6940.0
Component: Microsoft Exchange Information Store
Message: Error code error code returned from virus scanner initialization routine. Virus scanner was not loaded.
   
Explanation
This Error event is typically logged in one of the following conditions:

When you are using antivirus software that is not compatible with Exchange Server 2003.

When you have an antivirus program installed and the antivirus program is damaged. An antivirus program can be damaged for one or more of the following reasons:

You reinstall or restore Exchange Server from backup, but you do not reinstall the antivirus program.

You remove the antivirus program, but the removal of the program is incomplete or damaged.
Event 9581 may appear during upgrades from Exchange 2000 Server to Exchange Server 2003 or during the installation of Service Pack 2 on an Exchange 2000 server. The error code provided in event 9581 may help you discover the underlying cause. The two most common error codes seen in event 9581 are error code -2147221232 and Error code -1.

MSExchangeIS Error event 9564 may be logged with event 9581. Event 9564 indicates that the Microsoft Information Store Service was not able to start. Two of the common error codes seen in event 9564 are 0x80040110 and 0x3ee.
 
   
User Action
To resolve this issue, try one or more of the following:

Make sure that the antivirus software you are using is compatible with Exchange Server 2003. Contact your antivirus vendor to determine which version of antivirus software is compatible with Exchange Server 2003. For details, see Microsoft Knowledge Base article 49500, List of antivirus software vendors.
Note   If you determine that the software you are using is not compatible with Exchange Server 2003, disable the antivirus software on the server, and then restart the Information Store Service.

Make sure that you have correctly removed any antivirus software that you currently are not using. Contact your antivirus program vendor for information about how to correctly remove the antivirus program.

Make sure that you have correctly installed the antivirus software that you currently are using. Contact your antivirus program vendor if you have any questions about correct installation of the antivirus program.
For a general overview of antivirus support in Exchange Server 2003, see Microsoft Knowledge Base article 823166, Overview of Exchange Server 2003 and antivirus software.
 
« Last Edit: April 29, 2009, 12:41:59 AM by wpn »

wpn

  • Guest
Re: Migration to Avast not succesfull (Exchange 2007)
« Reply #14 on: April 29, 2009, 12:43:35 AM »
since i exceed the forums posting character limit a new message continueing previous posting:



Quote
 
Details
Product: Exchange
ID: 9564
Source: MSExchangeIS
Version: 8.0
Symbolic Name: msgidStartServer
Message: Error %1 starting the Microsoft Exchange Information Store.
%2.
    
Explanation
This Error event indicates that one or more databases on the server running Microsoft Exchange Server could not start. The event description contains extended information about the failure. Other related events may provide more specific information.
 
    
User Action
To resolve this error, do the following:

Review related Error and Warning events in the Application log. These related events may help you find the root cause of this error.

For more information, search for the error code specified in the event description on Search the Support Knowledge Base (KB).


Note  If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

 
    
    
Version: 6.5.6940.0
Component: Microsoft Exchange Information Store
Message: Error <error code> starting the Microsoft Exchange Information Store.
<error message>.
    
Explanation
Error starting the Microsoft Exchange Information Store service.
 
    
User Action
Check the event log on the server for more information. This behavior can occur when you have an antivirus program installed and the antivirus program is damaged. This can occur for one or more of the following reasons:

You reinstall or restore Exchange Server from backup, but you do not reinstall the antivirus program.
You remove the antivirus program, but the removal of the program is incomplete or damaged.