Microsoft KB Archive/946664

= Real-time scan operations time out when Forefront Security for SharePoint tries to scan small files =

Article ID: 946664

Article Last Modified on 12/20/2007

-

APPLIES TO


 * Microsoft Forefront Security for SharePoint

-



SYMPTOMS
On a computer that is running Microsoft Forefront Security for SharePoint, you may experience the following symptoms:  Real-time scan operations time out when Forefront Security for SharePoint scans small files. The following error information may be logged in the ProgramLog.txt file:  ( 8156- 3384), ERROR: The system cannot find the file specified The following information is part of the event; Pathway Net Application.aspx ( 8156- 7760), INFORMATION: sybarispvsapi.cpp::CSybariSPVsapi::Initialize: Initialize SPVSAPI in c:\windows\system32\inetsrv\w3wp.exe process  ( 6108- 4528), ERROR: SharePoint Realtime scan exceeded the allowed scan time limit.

( 8156- 3744), ERROR: Failed to load EventStrings-en_us.dll ( 8156- 3744), ERROR: The system cannot find the file specified. 

By default, the ProgramLog.txt file is located in the %ProgramFiles%\Microsoft Forefront Security\SharePoint folder.



CAUSE
This problem occurs if the following conditions are true:
 * Forefront Security for SharePoint tries to scan a file that is not a container file.
 * One of the following issues occurs:
 * The scan operation takes longer than the time-out value in Forefront Security for SharePoint.

Note By default, the time-out value is 10 minutes.
 * The scan operation returns a result of RPC_E_SERVERFAULT or STATUS_ACCESS_VIOLATION.

When this problem occurs, the SharePoint Virus Scanning API (VSAPI) hook cannot load the EventStrings.dll file. This behavior occurs because the SharePoint VSAPI tries to locate the EventStrings.dll file in the location from which the W3wp scan process is running. Instead, the SharePoint VSAPI should try to locate the EventStrings.dll file in the Forefront Security for SharePoint installation folder.

<div class="resolution_section">

How to obtain the hotfix
This issue is fixed in the Microsoft Forefront Security for SharePoint Service Pack 1 Rollup 1 Hotfix Package that was released December 20, 2007. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

943221 Description of the Forefront Security for SharePoint Service Pack 1 Rollup 1 package

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.

Keywords: kbhotfixserver kbqfe kbbug kbfix kbpubtypekc KB946664

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.