Sunday, February 12, 2012

Forefront Protection 2010 for Exchange Hotfix Rollup 4 and Kaspersky scan engine update errors

After installing FPE 2010 Hotfix Rollup 4 Kaspersky scan engine was not updating.
Event Viewer errors:

Event Type:        Error
Event Source:    GetEngineFiles
Event Category: Engine Error
Event ID:             6012
Description:
Microsoft Forefront Protection encountered an error while performing a scan engine update.
   Scan Engine: Kaspersky
   Error Code: 0x80004005
   Error Detail: Description: An error occurred while loading the scan engine.

Event Type:        Error
Event Source:    GetEngineFiles
Event Category: Engine Error
Event ID:             6019
Description:
Microsoft Forefront Protection encountered an error while performing a scan engine update.
   Scan Engine: Kaspersky
   Error Detail: An error occurred while testing the scan engine.
 
FPE Console:


Solution:

If running FPE on Windows 2003:

1.       Windows Explorer: turn on ‘Show hidden files and folders’
2.       C:\Documents and Settings\All Users\Application Data
            Rename ‘Kaspersky SDK’ (for example: rename Kaspersky SDK to Kaspersky SDK OLD)
3.       Update FPE engines

If running FPE on Windows 2008:
1.       Windows Explorer: turn on ‘Show hidden files, folders, and drives’
2.       C:\ProgramData\
           Rename ‘Kaspersky SDK’ (for example: rename Kaspersky SDK to Kaspersky SDK OLD)
3.       Update FPE engines

12 comments:

  1. Thanks it work for us...

    Regards,
    Manish

    ReplyDelete
  2. Great... It worked for us.........


    Pratit

    ReplyDelete
  3. Does not work for us, folder is not recreated after renaming to "Kaspersky SDK OLD".

    ReplyDelete
    Replies
    1. Solution for us is:
      Delete the file Storage520.dat *!!AND ALL OTHERS!!* located in the folder c:\Program Data\Kaspersky SDK and try a manual update.

      See here:
      http://social.technet.microsoft.com/Forums/en-US/FSENext/thread/9de3b6b5-d071-42c7-947e-9dc6aac5f3c4

      Delete
  4. I have the Microsoft engine failing today. Is the procedure the same?
    Microsoft Forefront Protection encountered an error while performing a scan engine update.
    Scan Engine: Microsoft
    Error Code: 0x80004005
    Error Detail: Description: An error occurred while loading the scan engine.
    Microsoft Forefront Protection encountered an error while performing a scan engine update.
    Scan Engine: Microsoft
    Error Detail: An error occurred while testing the scan engine.

    ReplyDelete
  5. Same issue here, happening in all mailbox servers today

    I get event ID 6012 source: get enginefiles

    Microsoft Forefront Protection encountered an error while performing a scan engine update.
    Scan Engine: Microsoft
    Error Code: 0x80004005
    Error Detail: Description: An error occurred while loading the scan engine.

    Followed by Event ID 6019, source get engine files
    Microsoft Forefront Protection encountered an error while performing a scan engine update.
    Scan Engine: Microsoft
    Error Detail: An error occurred while testing the scan engine.

    ReplyDelete
  6. Same issue here, also happening in all mailbox servers today.

    I get event ID 6012, and 6019 Source: get enginefiles

    Microsoft Forefront Protection encountered an error while performing a scan engine update.
    Scan Engine: Microsoft

    ReplyDelete
  7. I'm the same anonymous poster listed at 8:25am today.

    Interestingly enough, i was getting ready to give Microsoft a call, it's 9:52am here, but all my servers are now able to downmload the Microsoft engine update that was failing.

    I see they were failing before yesterday, same Microsoft engine, but not as often as today, where all Exchange 2010 mailbox servers seemed to have gone mad trying to update the Microsoft antimalware engine.

    I'll keep an eye on the next hourly update schedule.

    ReplyDelete
  8. I have been using Kaspersky security for a few years, and I'd recommend this anti-virus to all of you.

    ReplyDelete
  9. This comment has been removed by the author.

    ReplyDelete
  10. This comment has been removed by the author.

    ReplyDelete
  11. This comment has been removed by the author.

    ReplyDelete