Hi, I have instaled SMSMSE 7.5 in 5 server with windows 2008 r2, exchange standard 2010 (in spanish).
Some days ago I have in application log event 1000, followed of event 1001 (windows error Reporting), event 168 (prcess restarted) and event 218 (file unscannble)
Copy text of events:
Nombre de registro:Application
Origen: Application Error
Fecha: 23/06/2014 09:36:06 a.m.
Id. del evento:1000
Categoría de la tarea:(100)
Nivel: Error
Palabras clave:Clásico
Usuario: No disponible
Equipo: xxxxxxxxxx
Descripción:
Nombre de la aplicación con errores: SAVFMSESp.exe, versión: 7.5.0.56, marca de tiempo: 0x52f4c2f4
Nombre del módulo con errores: ntdll.dll, versión: 6.1.7601.18247, marca de tiempo: 0x521ea8e7
Código de excepción: 0xc0000374
Desplazamiento de errores: 0x000ce753
Id. del proceso con errores: 0x1d24
Hora de inicio de la aplicación con errores: 0x01cf8ef0fdbfbf5e
Ruta de acceso de la aplicación con errores: C:\Program Files (x86)\Symantec\SMSMSE\7.5\Server\SAVFMSESp.exe
Ruta de acceso del módulo con errores: C:\Windows\SysWOW64\ntdll.dll
Id. del informe: 1aa91a60-fae5-11e3-900d-00155d0add12
XML de evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-06-23T14:46:06.000000000Z" />
<EventRecordID>397940</EventRecordID>
<Channel>Application</Channel>
<Computer>xxxxxxxxxxxx</Computer>
<Security />
</System>
<EventData>
<Data>SAVFMSESp.exe</Data>
<Data>7.5.0.56</Data>
<Data>52f4c2f4</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.18247</Data>
<Data>521ea8e7</Data>
<Data>c0000374</Data>
<Data>000ce753</Data>
<Data>1d24</Data>
<Data>01cf8ef0fdbfbf5e</Data>
<Data>C:\Program Files (x86)\Symantec\SMSMSE\7.5\Server\SAVFMSESp.exe</Data>
<Data>C:\Windows\SysWOW64\ntdll.dll</Data>
<Data>1aa91a60-fae5-11e3-900d-00155d0add12</Data>
</EventData>
</Event>
Nombre de registro:Application
Origen: Symantec Mail Security for Microsoft Exchange
Fecha: 23/06/2014 09:37:21 a.m.
Id. del evento:218
Categoría de la tarea:(16)
Nivel: Advertencia
Palabras clave:Clásico
Usuario: No disponible
Equipo: xxxxxxxxxxxxxxxxxxxxxxxx
Descripción:
The attachment "Ranking 23 de Junio 2014.pdf" located in message with subject "Ranking Ventas 23 de Junio 2014", located in SMTP has violated the following policy settings:
Scan: Auto-Protect
Rule: Unscannable File Rule
The following actions were taken on it:
The attachment "Ranking 23 de Junio 2014.pdf" was Deleted for the following reason(s):
Scan Engine error. Error code: 0xC0090086
For more information, visit https://entced.symantec.com/entt?product=SMSMSE&build=symantec_ent&version=7.5.0.56&language=english&module=event_logging&error=218 .
XML de evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Symantec Mail Security for Microsoft Exchange" />
<EventID Qualifiers="32784">218</EventID>
<Level>3</Level>
<Task>16</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-06-23T14:37:21.000000000Z" />
<EventRecordID>397924</EventRecordID>
<Channel>Application</Channel>
<Computer>xxxxxxxxxxxxxxx</Computer>
<Security />
</System>
<EventData>
<Data>attachment</Data>
<Data>Ranking 23 de Junio 2014.pdf</Data>
<Data>message with subject "Ranking Ventas 23 de Junio 2014", located in SMTP</Data>
<Data> Scan: Auto-Protect
Rule: Unscannable File Rule
</Data>
<Data> The attachment "Ranking 23 de Junio 2014.pdf" was Deleted for the following reason(s):
Scan Engine error. Error code: 0xC0090086</Data>
<Data>https://entced.symantec.com/entt?product=SMSMSE&build=symantec_ent&version=7.5.0.56&language=english&module=event_logging&error=218</Data>
</EventData>
</Event>
I reviewed tech documents and I apllied to allow malformed (http://www.symantec.com/business/support/index?page=content&id=HOWTO59051&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D14035367571975tyJNtRx11mUqxy555kcUl5xFaSVHkvpOJk9m)
The problem is running in my 5 exchange server, and the files type is anything (jpg, txt, pdf,...)