Announcement

Collapse
No announcement yet.

Antigen crashes and disables mailflow.

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Antigen crashes and disables mailflow.

    I am having a serious problem with Antigen 9 SP2. My server is Windows 2003 R2 SP2 running Exchange 2003 SP2 with Antigen 9 SP1. On a fairly frequent basis Antigen will error out on an internet scan and throw this event in the event viewer:

    EVENT LOG Application
    EVENT TYPE Error
    SOURCE AntigenSmtpSink
    CATEGORY Scan Error
    EVENT ID 5015
    COMPUTERNAME EXCHANGE
    DATE / TIME 2/15/2012 8:06:50 AM
    MESSAGE Internet scan exceeded the allotted scan time limit while processing message ( My password).

    This error is repeated over and over for each email message that Antigen attempts to process after this.

    All message scanning stops but more alarmingly all message flow stops as well. Messages pile up in the SMTP Categorizer queue. The only way to restore scanning and mail flow at this point is to reboot the server, restarting services or the Default SMTP server won't work. The most recent time this happened I had to completely uninstall Antigen to get mail flow working again.

    The only solution that I have been able to find for this after searching extensively online is to modify the internet scan timeout in the registry. I have mine set to 10 minutes and still have the same problem.

    Here are some other errors I have seen that are related to this:

    FILE QUARANTINED
    ----------------
    The original contents of this file have been replaced with this message because of its characteristics.
    File name: "Body of Message"
    Virus name: "Exceeded Internet Timeout"

    EVENT LOG Application
    EVENT TYPE Error
    SOURCE AntigenSmtpSink
    CATEGORY Server/IMC Error
    EVENT ID 4007
    COMPUTERNAME EXCHANGE
    DATE / TIME 2/15/2012 9:58:32 AM
    MESSAGE Internal error 3-6, method returned 0x800706ba.

    EVENT LOG Application
    EVENT TYPE Error
    SOURCE AntigenInternet
    CATEGORY Scan Error
    EVENT ID 5008
    COMPUTERNAME EXCHANGE
    DATE / TIME 2/15/2012 9:56:28 AM
    MESSAGE Unable to register internet scan.

    EVENT LOG Application
    EVENT TYPE Error
    SOURCE AntigenInternet
    CATEGORY Scan Error
    EVENT ID 5001
    COMPUTERNAME HERMES
    DATE / TIME 2/15/2012 9:57:32 AM
    MESSAGE Unable to create sybari service.

    I need help!
Working...
X