Microsoft KB Archive/946662

= Real-time scan operations time out, and event IDs 2054 and 28721 are logged on a computer that is running Forefront Security for SharePoint =

Article ID: 946662

Article Last Modified on 12/20/2007

-

APPLIES TO


 * Microsoft Forefront Security for SharePoint

-



SYMPTOMS
On a computer that is running Microsoft Forefront Security for SharePoint, you experience the following symptoms:  Real-time scan operations time out. When this problem occurs, you receive the following error messages.

Error message 1

960013: Antivirus scanner timed out.

Error message 2

GetSPAVSettingScanTimeout 0x80020009.

 The following error information may be logged in the ProgramLog.txt file:

ERROR: The system cannot find the file specified. The following information is part of the event; Pathway Net Application.aspx

ERROR: SharePoint Realtime scan exceeded the allowed scan time limit.

ERROR: Failed to load EventStrings-en_us.dll ERROR: The system cannot find the file specified. ERROR: GetSPAVSettingAttemptToClean 0x80020009 ERROR: GetSPAVSettingAttemptToClean 0x80020009 ERROR: GetSPAVSettingScanTimeout 0x80020009 ERROR: GetSPAVSettingScanTimeout 0x80020009 ERROR: GetSPAVSettingAttemptToClean 0x80020009

By default, this file is located in the %ProgramFiles%\Microsoft Forefront Security\SharePoint folder.  The following events may be logged in the Application event log.

Event ID 2054 Event Type: Error

Event Source: FSSPController

Event Category: (2)

Event ID: 2054

Date:

Time:

User: N/A

Computer:

Description: The description for Event ID ( 2054 ) in Source ( FSSPController ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: UKFlag.gif. Event ID 28721 Event Type: Error

Event Source: Windows SharePoint Services 3

Event Category: (1105)

Event ID: 2054

Date:

Time:

User: N/A

Computer:

Description: The description for Event ID ( 28721 ) in Source ( Windows SharePoint Services 3 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: #960013: Antivirus scanner timed out. 



CAUSE
This problem occurs if the SharePoint Virus Scanning API (VSAPI) hook tries to load the EventStrings.dll file incorrectly. In this scenario, Forefront Security for SharePoint cannot load the EventStrings.dll file successfully. Therefore, the scanning operation is unsuccessful.



How to obtain the hotfix
This issue is fixed in the Microsoft Forefront Security for SharePoint Service Pack 1 Rollup 1 Hotfix Package that was released December 20, 2007. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

943221 Description of the Forefront Security for SharePoint Service Pack 1 Rollup 1 package



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.

Keywords: kbqfe kbbug kbfix kbpubtypekc kbtshoot kbprb KB946662

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.