I am having exactly the same problem. Does anyone have a fix ?
Awil has written a fix, which I am currently testing for them. So far, so good.
David, are you also getting the “Microsoft Exchange Intelligent Message Filter was refreshed” message just before the problem starts taking place?
Thanks
Vlk
Vlk,
Here’s a very interesting observation:
-
IMF updates are issued by Microsoft only two times per month.
-
Before the Avast 4.8.1049 upgrade, the ID 7513 events occurred only a few times each month.
-
After the Avast 4.8.1049 upgrade, the ID 7513 events are occurring every two hours almost exactly (plus or minus a few minutes each time).
I suspect, therefore, that Avast 4.8.1049 is somehow causing the ID 7513 events every two hours, perhaps by restarting the SMTP service. In other words, the ID 7513 events are a symptom of a problem in Avast which occurs every two hours, not the cause of the problem.
What does Avast do every two hours, plus or minus a few minutes? Does Avast attempt a VPS update? Is the SMTP service involved?
I’m experiencing the same problem. Running a SBS2003. Since the Avast update, Exchange hangs up with error code 348: “A message could not be virus scanned - this operation will be retried later. Internet Message ID <…>”
As kwg wrote, restarting the Exchange Information Store service helps for a while.
But here seems no correlation to event ID 7513. I have no 7513 entries in the logs. But ID 9661 which says “standard filtering level for unrequested commercial e-mail has been updated. The new value is 8.” (sorry for translation, I have German language event logs ;))
Is there a fix available, yet?
I have the same problem after update from 4.7 to 4.8. Server 2003 with Exchange server 2003 SP2.
I’ve just deinstalled AVAST and now for 3 hours no problems, otherwise I had to restart Information Store and AVAST engine every 2 hours. I will reinstall when a fix is availlable.
Guys,
it would be helpful if you could create a dump of the store.exe process at the moment the problem is simulated.
To do this, please download http://public.avast.com/~vlk/userdump.exe
Once the problem is simulated, run
userdump store.exe c:\store.dmp
This will create a file store.dmp in C:\ (a memory dump of the Exchange IS process). Zip it and upload it to ftp://ftp.avast.com/incoming (please note that you won’t have READ access to the ftp site, just WRITE).
Thanks
Vlk
I did send Vlk a dump created just 5 seconds after the event occurred. Since the dump is half a gigabyte in size, and the Avast “Incoming” directory is write-only, I don’t know yet whether my upload was successful.
We are now also seeing this problem on 2 customers’ servers. It’s very bad. Has anyone tried turning off IMF to see if that helps?
Regards,
Edmund
Hello!
This one is a massive problem!!!
I have got 12 (twelve!!!) customers out there which cannot receive mails since the update - same error as mentioned above.
What i have already tried:
- restart services: no effect
- uninstall avast scanner & reboot: mails can be received again - but no virus scanning of course
- reinstall avast server edition (SBS & standard versions): works for about 3 hours - then same error again
- deactivated IMF & restarted services: works for 4-5 mails; then crashes again
So currently, only UNINSTALLING avast scanner brings back a functional solution -
we REALLY need a patch on this !!!
Hello,
I don’t know if you’ve communicated with Vlk by e-mail, but the upload on the FTP is only 2 megabytes in size - i.e. it’s not complete.
Could you possibly try to upload again? (or, if you have a webspace of your own, put it there for download, probably in a form of a password-protected archive?)
Thanks.
I am currently uploading the file to a different server. I will let Vlk know when the upload is complete and how to retrieve the file.
I have e-mailed Vlk with instructions for retrieving the file from my server.
We’re experiencing the same, more details:
- emails are being sent out just fine.
- incoming emails are sitting on the pending queue and not being delivered to local mailboxes.
- event log is showing IMF being restarted, which i suspect is due to a restart of the smtp service more than anything.
- this has happened since avast auto-updated on the windows 2003 sbs on sunday. Monday morning, start of business, was a firefighting session of trying to get ever growing queues to deliver.
- all this was solved by disabling the local exchange and smtp scanners in avast. queue sizes dropped to nothing almost straight away.
The current result is that we are getting email delivered locally, but not virus scanned however. I’ve not seen requirement to uninstall avast. Just disabling the exchange and smtp scanner seems to fix it (after the smtp service is restarted).
Note however, that on reboot of the server, avast will be restarted again and delivery will fail once more.
Same problem here…
SBS2003 UK SP2.
Quick solution when no mail is deliverd anymore.
disable avast
start=>run=>issreset
then restart the mailstore
then from the Exchange systemmanager go to => servers => {servername} => queues
Right klik Messages pending submission and choose freeze… Then wait 5 seconds and then klik it again and choose force connection.
Now the messages will be deliverd again…
I find that the following two-step procedure is sufficient to restore delivery:
- Restart the Microsoft Exchange Information Store service.
- Force a connection with the Pending queue.
The Avast Exchange provider restarts immediately on its own after Step 1.
sometimes an ISSRESET is necessary 
Guys, just a small status update.
We’re still investigating the issue. Hopefully, there will be a fix in the upcoming couple of days.
Thanks
Vlk
BTW one thing to try:
please go to avast settings, “Update (Basic)” page, click Details, and uncheck the “Enable” box in the “Push iAVS” section. Confirm with OK, and monitor if it makes any difference.
Thanks
Vlk
Try this
http://support.microsoft.com/kb/843545
and disable transport level in Avast task->Resident protection ->Exchange2000/2003 Scanning settings.
…maybe