Microsoft KB Archive/922358

= Microsoft Systems Management Server 2003 Inventory Tool for Microsoft Updates cannot run when a McAfee antivirus program is installed on the same computer =

Article ID: 922358

Article Last Modified on 5/17/2007

-

APPLIES TO


 * Microsoft Systems Management Server 2003

-



SYMPTOMS
Consider the following scenario. You use the Microsoft Systems Management Server (SMS) 2003 Inventory Tool for Microsoft Updates (ITMU) to scan for updates on a computer. The computer is also running a McAfee Antivirus program. In this scenario, ITMU may not be able to start the security update scanning tool (Scanwrapper.exe).

Additionally, you may receive an error message that resembles the following in the SmsWusHandler.log:

Scan process started with cmdline = /Catalog:C:\WINNT\system32\VPCache\NOV00027\wsusscan.cab /OutputXml:C:\WINNT\system32\VPCache\NOV00027\Results.xml

SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764)

WUS client version detected on the machine = 5.8.0.2469.

SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764)

Running the SMS WUS Handler in scan mode

SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) LocaleID= will be used to get localized properties.

SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) Searching for all the ServicePacks now

SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) Search filter - CategoryIDs contains '68C5B0A3-D1A6-4553-AE49-01D3A7827828'

SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) Using C:\WINNT\system32\VPCache\NOV00027\wsusscan.cab as the offline-catalog.

SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) AddScanPackageService failed. SmsWusHandler 9/28/2005 3:55:44 PM 1892 (0x0764)

ERROR: Search failed with hRes=0xc8000408

SmsWusHandler 9/28/2005 3:55:44 PM 1892 (0x0764) 0xc8000408 is the result value for the operation. Returning 1032 as the exit code.

SmsWusHandler 9/28/2005 3:55:44 PM 1892 (0x0764)

You may also receive an error message that resembles the following in the SmsWusHandler.log on the client:

4/9/2007 4:36:25 PM ~======== SmsWusHandler Started ========

4/9/2007 4:36:25 PM Scan process started with cmdline = /Catalog:C:\WINNT\system32\VPCache\NUS001F1\wsusscn2.cab /OutputXml:C:\WINNT\system32\VPCache\NUS001F1\Results.xml

4/9/2007 4:36:25 PM WUS client version detected on the machine = 5.8.0.2694.

4/9/2007 4:36:25 PM Running the SMS WUS Handler in scan mode

4/9/2007 4:36:25 PM LocaleID= will be used to get localised properties.

4/9/2007 4:36:25 PM Searching for software updates now.

4/9/2007 4:36:25 PM Search filter - Type='Software'

4/9/2007 4:36:25 PM Using C:\WINNT\system32\VPCache\NUS001F1\wsusscn2.cab as the offline-catalog.

4/9/2007 4:36:25 PM Registering a new scan package service with the Windows Update Agent.

4/9/2007 4:36:32 PM Scan Package serviceID being used for this search is {a5228644-8401-4e16-98b5-78344cb2452f}

4/9/2007 4:36:52 PM ERROR: UpdateSearcher::Search failed.

4/9/2007 4:36:52 PM An error occurred when searching with the existing scan package service. Removing the service...

4/9/2007 4:36:52 PM ERROR: Search failed with hRes=0xc80001fe

4/9/2007 4:36:52 PM 0xc80001fe is the hresult value for the operation. Returning 510 as the exit code.

4/9/2007 4:36:52 PM ~ ======= SmsWusHandler Terminating =======



CAUSE
This problem occurs when the McAfee antivirus program is configured to scan the \SoftwareDistribution folder on the computer on which the ITMU scan is run. In this case, when the McAfee antivirus program scans the .edb file, the antivirus program locks the file. Therefore, the ITMU cannot access the .edb file.



WORKAROUND
To work around this problem, make sure that the McAfee antivirus program does not scan the files in the \SoftwareDistribution folder on any computer on which the Windows Update Agent is installed.

For computers that are running Microsoft Windows Server 2003, Microsoft Windows 2000, or Microsoft Windows XP, do not scan the following files and folders. These files are not at risk of infection. If you scan these files, serious performance problems may occur because of file locking. Where a specific set of files is identified by name, exclude only those files instead of the whole folder. Sometimes, the whole folder must be excluded. Do not exclude any one of these items based on the file name extension. For example, do not exclude all files that have a .dit extension. Microsoft has no control over other files that may use the same extensions as the following files:  Microsoft Windows Update or Automatic Update related files The Windows Update or Automatic Update database file. This file is located in the following folder:

%windir%\SoftwareDistribution\Datastore

Exclude the Datastore.edb file. The transaction log files. These files are located in the following folder:

%windir%\SoftwareDistribution\Datastore\Logs

Exclude the following files:  Edb*.log

Note The wildcard character indicates that there may be several files. Res1.log Res2.log Edb.chk</li> Tmp.edb</li></ul> </li></ul>

For more information about virus scanning recommendations for computers that are running Windows Server 2003, Windows 2000, or Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:

822158 Virus scanning recommendations for computers that are running Windows Server 2003, Windows 2000, or Windows XP

For more information about McAfee antivirus, refer to the McAfee antivirus documentation.

<div class="moreinformation_section">

For information about how to contact McAfee, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and software vendor contact information, A-K

60781 Hardware and software vendor contact information, L-P

60782 Hardware and software vendor contact information, Q-Z

Keywords: kbtshoot kbprb KB922358

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.