Symantec Mail Security for Exchange (SMSMSE) Processes Cannot Start. Windows Application Event Log Contains Event IDs 110, 168, 68, and 167 When Library c:\windows\syswow64\MSVCP71.dll is Missing

Article:TECH158723  |  Created: 2011-04-25  |  Updated: 2014-06-02  |  Article URL http://www.symantec.com/docs/TECH158723
Article Type
Technical Solution

Product(s)

Issue



SMSMSE processes do not start up.  SMSMSE does not scan email.

  • After turning on debug logging for SMSMSE the following events are seen in the Windows Application Event log:

Information    3/27/2011 19:53    Symantec Mail Security for Microsoft Exchange    170    Error    "Process: SAVFMSESp(D84), File: \AVEngine.cpp, Line: 471:   HRESULT=0x80004005 - Unspecified error"

This event occurs when the decomposer engine cannot be initialized.

Use steps 1 and 2 from the Enable Logging section of this article: How to Obtain Debug Logs for Symantec Mail Security for Microsoft Exchange (SMSMSE).

NOTE:  The line number in the error event may be specific to a particular version of SMSMSE.  This line number was taken from SMSMSE 6.5.2.

Conditions

  • Running a procmon log shows the following sequence occuring:

29:53.0    SAVFMSESp.exe    1120    Load Image    C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\Dec2LHA.dll    SUCCESS    Image Base: 0x15e0000, Image Size: 0x14000
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\SysWOW64\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\system\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\SysWOW64\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\SysWOW64\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\SysWOW64\wbem\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Windows\idmu\common\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Program Files (x86)\ExchangeMapi\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Program Files\Microsoft\Exchange Server\Bin\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
8:29:53 PM    SAVFMSESp.exe    1120    CreateFile    C:\Program Files\Microsoft\Exchange Server\Scripts\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a

 

This shows the decomposer loading the library Dec2LHA.dll.  The decomposer then attempts to load the library MSVCP71.dll but is unable to find it.

Here is an example of a procmon log from a working system:


14:12.6    SAVFMSESp.exe    6556    Load Image    C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\Dec2LHA.dll    SUCCESS    Image Base: 0xec0000, Image Size: 0x14000
14:12.6    SAVFMSESp.exe    6556    CloseFile    C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\Dec2LHA.dll    SUCCESS   
14:12.6    SAVFMSESp.exe    6556    QueryOpen    C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\MSVCP71.dll    FAST IO DISALLOWED
14:12.6    SAVFMSESp.exe    6556    CreateFile    C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\MSVCP71.dll    NAME NOT FOUND    Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
14:12.6    SAVFMSESp.exe    6556    QueryOpen    C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\Dec2RAR.dll    FAST IO DISALLOWED

 

This shows the decomposer loading the library Dec2LHA.dll.  The decomposer then loads the library MSVCP71.dll.  Then the decomposer loads the library Dec2RAR.dll.

 

 


Error



  • Windows Application Event log contains the following events:

    Event ID 110 - The process SavFmsesp.exe failed to start (0xC009008A).

    Event ID 168 - The process SAVFMSESp.exe was restarted.

    Event ID 68 - Unable to initialize scan engine. The virus definitions may be missing or corrupt. Perform a liveupdate to retrieve the latest virus definitions.

    Event ID 167 - The process SAVFMSESp.exe terminated unexpectedly.

 


Environment



  • SMSMSE 6.5.2 or higher.

Cause



The library MSVCP71.dll is missing from the directory c:\windows\syswow64.


Solution



Find a system that contains the library c:\windows\syswow64\MSVCP71.dll and copy it to the system that is missing the library.




Article URL http://www.symantec.com/docs/TECH158723


Terms of use for this information are found in Legal Notices