Migration to Avast not succesfull (Exchange 2007)

Avast Business Avast Server Protection
1

Hello,

Tonight we had our migration to Avast scheduled and this for our entire server park…
Not everything went smoothly :-
We had 1 major incident related to our exchange 2007 server…

What preparational work was done:
An installation package was made on the ADNM with following providers/Plugin:

  • Network shield
  • Web shield
  • Standard shield
  • Script blocking
  • The Bat!

Plugin: Exchange 2007

After removing the previous AV solution and rebooting the server, the package was pushed from our ADNM to the exchange server.
After installation, the exchange services were stopped and the server was rebooted.

After reboot, the Outlook 2003 clients did not connect while the Avast netServer Client was running.
After some checking it seemed that the problem was the MS Exchange Information Store not running.
Impossible to start and any attempts to start it resulted in error code 0 0x0…

After some troubleshooting, we deinstalled the package that was pushed with the ADNM, rebooted the server and decided to install the standalone Server Edition package…

After the reboot the server booted with another new error message:

Exchange MDB encountered an issue and had to be closed.
The server was again rebooted. After reboot, the outlook clients seemed to connect, but it was impossible to send/receive mails…

During the install I setup my mail account to receive mails with the log entries… this resulted in 11000 mails in my inbox.

One of them: [MP-EXC01]: AAVM - scanning error: ClientRqDispatchThread: SessionID not found - global map corrupted??, 000017B6.

So at the end of the day, we came also to deinstall the standalone Avast Server Edition and ended up with no protection at all (our previous AV solution has been decommisioned entirely tonight)

Highly appreciated if someone could assist with this.

Cheers,
Mario

2

i dont know why u have THE BAT in ur provider list, but its not needed on an exchange 2007 server…
see this thread for provider needed on an exchange server: http://forum.avast.com/index.php?topic=15452.0

did u check in the EVENTLOG from the exchange server why the service didnt start?

i noticed in my virtual test enviroment with a clean install that exchange was b*tching about an invalid AV sollution
(same problem here: http://forum.avast.com/index.php?topic=40960.0) although i obviously never installed another
av solution before on my clean test server… (test server win2k8 64bit + exchange 2007 64bit, so production standards)

i did the registry setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled key to “0” like mentioned in the last posting i just gave u and i started the service again succesfull.
While running the exchange service i changed the setting to 1 again and i rebooted the server again and it did start succesfull now with the exchange scanner provider running…
Unfortuanately i cant test this right now anymore since i cleaned my test enviroment again, in the near future i will try it again tho

hopefully this is what u are looking for

3

Hello wpn,

Thanks - I’m going to look into these references you gave.
I need to schedule again downtime to do testing/installation so I’ll get back to you with my results…

Cheers,
Mario

4

Wpn,

I have an additional question: is there some place where I can find documentation on the netServerClient/Avast Server Edition ?
I found good documents related to the Avast Professional client (enduser), but except for a one pager nothing usefull that could help build up some knowledge on settings etc…
The Bat! is something that I was still looking for to find some more details…

Cheers,
Mario

5

i cant give u any documents with information since all information i have is from the forum here or figuring out in my VM’s by just trying…
(admitted, i didnt read the manuals completely, just 1 time the ADNM manual partially to setup up ADNM for the very very first time)

i do however know that THE BAT is an email client ( i used it for a while but its not free ) which i assume in an exchange enviroment you will use outlook for becuz of the integration and the non-pop usage…

not to be rude here but 2 questions:

  1. why migrate an entire server park (sounds big, but is it?) at once?
  2. didnt you test this with a clean test setup and a copy of your production enviroment ? (dont get me wrong i love experimenting, but not really on my production enviroment ;))
6

Hello wpn,

To answer your 2 questions:

  1. we have little opportunity to bring down our server park - so when we bring it down - we need to move forward with things hence the reason why we have migrated the full server park in one go.

  2. Everything was tested first in a virtual server environment, so we tought we had everything tacled. Only 1 server in our server park failed so I would say that things went more or less OK.

Regarding the documentation:
I do not find it normal that there’s no addititional information available, next to the onepager. It’s not like am having nothing else to do then to surf the forum to find my answers. I think all companies that have a serious IT department, who have external audits, etc, are in need of these things. It’s really unbelievable that they do not exist.

Tonight, I’m trying to migrate our exchange server again. Will come back and let you know how it went…
Thanks for your response !

Mario

7

So here is the result of the migration to Avast for our Exchange 2007 server:

I have remotely deployed a netServer package.
Enabled providers are Network Shield and Web Shield and the Exchange 2007 additional feature. Only language selected is English.
This package was sent to the server and installed perfectly. I did not have Avast reboot the server. I first stopped all exchange services and then initiated manually a reboot…

When rebooted, the Avast app was running in the Systray, saying 3 providers, 2 running.
Our Outlook clients were unable to connect to the exchange server however.

Checking the same thing as last time: indeed - the exchange information store service did not come up…
Tried to start it: not possible - same error as last time…

Went into the registry: changed the suggested value to 0:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled

Tried again to start the MSExchangeIS service: within a couple of seconds the service was up and running and the Outlook clients could connect…

Went back into the registry, changed the value back to 1.

Stopped all exchange services and restarted the server: same scenario - Avast is OK, MSExchangeIS isn’t - service is not running…

Same ritual: reg key back to 0, start service, reg key back to 1…

This obviously isn’t working: next time our server is being patched with the latest Windows updates, it will be rebooted and mail services won’t be functional after the reboot…

In the event viewer (system log), I find following message:

The Microsoft Exchange information Store service terminated with a service-specific error 0 (0x0).

That’s all to be found in there…

Someone, anyone ?

8

I had the same problem with an SBS 2008 server. However, they come with forefront security installed, which caused problems such as this.

After removing all MS anti-virus software, avast and exchange started talking to each other properly.

Also, did you have any other (non-MS) anti-virus installed previously? It could cause the problem as well.

9

Which OS are you using for the exchange box??

Windows 2008 server or windows 2003 server?

im gonna test this in a virtual enviroment again now cuz im positive it worked for me what i wrote, but that was on a clean install…

ill see if i can test a 2003 setup this weekend tho i only have the 32bit version of 2003 server (which is not a production supported version for exchange 2007)

i will let u know what happend

10

Hey,

@scythe944:
We were running CA eTrust before, which was uninstalled. The box was fully restarted after the uninstallation.
The reg key, …/VirusScan was not in the registry after the uninstallation of eTrust and prior to the installation of Avast.
It was only after the installation of Avast I could locate it and change the sub key “enabled” to “0” to startup the MS Exchange Information Store Service…

Can you think of any thing else (remainders of eTrust,…) that could be causing my issues ?

@wpn:
The OS is Windows Server 2003 R2 Enterprise x64 Edition with Service Pack 2
(the physical machine is a HP Proliant box - Intel Xeon CPU E5320 1.8 Ghz and 8Gb of RAM)

Thanks for your help in this. It’s very much appreciated !!

P.S. Do you get email notifications when someone replies to a forum post ? I always have to come and look to see whether you guys have been online. Would be great to have somekind of a notification - I would be able to respond much quicker ;D

11
(remainders of eTrust,...) that could be causing my issues

Quite a possibility! Google etrust removal tool and see what you find. Many problems that are posted on this forum are due to remnant A/V programs.

12

i promised u to check out this stuff in the weekend but i got crowded, so i wanted to do it today (monday) but this afternoon my exchange server went down and i got it up at 17:00 and im still praying that nobody is sending bigger e-mail then 10kb a time so the server wont go down again… so for now that has my priority, sorry
when i get time to test this i will test it

13

Take your time bro, we’ll be here. Well, hopefully!

14

im testing with this virtual setup:

win2k8 Ent DC 64bit
Win2k3 Ent R2 64bit
WinXP 32bit client for the avast software
i dont know whats wrong but my vm’s are slow as h*ll at this moment
just installed avast, so ill let u know what will happen when i get it done with this speed

edit:

echange installation package:
avast server
network shield
web shield
standard shield
script blocking (this coudl be left out i guess)
exchange 2007 plugin

after reboot the store didnt come up
i changed the regkey to 0 and it came up
i changed the regkey to 1 again and restarted the service, but it failed to start

in the app. event viewer on the exchange server i get:
Error code 1006 returned from virus scanner initialization routine. Virus scanner was not loaded.
eventid: 9581
source: MSExchangeIS
category: Virusscanning
and
Error 0x3ee starting the Microsoft Exchange Information Store.
Failed to init VSERVER.
eventid: 9564
source: MSExchangeIS
category: General

in the sys event viewer on the exchange server i get:
The Microsoft Exchange Information Store service terminated with service-specific error 0 (0x0).
eventid: 7024
source: Service Control Manager

in the avast event viewer on the exchange server i get:
VSAPI: Avast has not started yet. Will keep waiting…
eventid: 26921
source: avast!
category: (12)

this is done in a totally clean installation
so far my findings, im gonna test some more

hopefully Avast crew is reading this too so they can eithe come up with the solution (since a lot of people have the same problem) or a clear explanation on what cuold have been done wrong…

this is the text from MS when u click on the link in the event viewer details window
i post them one by one:

Details Product: Exchange ID: 9581 Source: MSExchangeIS Version: 8.0 Symbolic Name: msgidVSErrorInitialize Message: Error code %1 returned from virus scanner initialization routine. Virus scanner was not loaded.

Explanation
This Error event is typically logged for one of the following conditions:

When you are using antivirus software that is not compatible with Microsoft Exchange Server 2007.

When you have an antivirus program installed, and the antivirus program is damaged. An antivirus program can be damaged for one or more of the following reasons:

You reinstall or restore Exchange Server from backup, but you do not reinstall the antivirus program.

You remove the antivirus program, but the removal of the program is incomplete or damaged.

The error code provided in event 9581 may help you discover the underlying cause.

The Microsoft Exchange Information Store service (MSExchangeIS) Error event 9564 may be logged with event 9581. Event 9564 indicates that the Microsoft Exchange Information Store service was not able to start.

User Action
To resolve this error, try one or more of the following:

Make sure that the antivirus software you are using is compatible with Exchange 2007. Contact your antivirus vendor to determine which version of antivirus software is compatible with Exchange 2007. For details, see Microsoft Knowledge Base article 49500, List of antivirus software vendors.

Note If you determine that the software you are using is not compatible with Exchange 2007, disable the antivirus software on the server, and then restart the Microsoft Exchange Information Store service.

Make sure that you have correctly removed any antivirus software that you currently are not using. Contact your antivirus vendor for information about how to correctly remove the antivirus program.

Make sure that you have correctly installed the antivirus software that you currently are using. Contact your antivirus vendor if you have any questions about correct installation of the antivirus program.

For a general overview of antivirus support in Exchange Server, see Microsoft Knowledge Base article 823166, Overview of Exchange Server 2003 and antivirus software.

Note If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Version: 6.5.7638.0
Component: Microsoft Exchange Information Store
Message: Error code returned from virus scanner initialization routine. Virus scanner was not loaded.

Explanation
This Error event is typically logged in one of the following conditions:

When you are using antivirus software that is not compatible with Exchange Server 2003.

When you have an antivirus program installed and the antivirus program is damaged. An antivirus program can be damaged for one or more of the following reasons:

You reinstall or restore Exchange Server from backup, but you do not reinstall the antivirus program.

You remove the antivirus program, but the removal of the program is incomplete or damaged.
Event 9581 may appear during upgrades from Exchange 2000 Server to Exchange Server 2003 or during the installation of Service Pack 2 on an Exchange 2000 server. The error code provided in event 9581 may help you discover the underlying cause. The two most common error codes seen in event 9581 are error code -2147221232 and Error code -1.

MSExchangeIS Error event 9564 may be logged with event 9581. Event 9564 indicates that the Microsoft Information Store Service was not able to start. Two of the common error codes seen in event 9564 are 0x80040110 and 0x3ee.

User Action
To resolve this issue, try one or more of the following:

Make sure that the antivirus software you are using is compatible with Exchange Server 2003. Contact your antivirus vendor to determine which version of antivirus software is compatible with Exchange Server 2003. For details, see Microsoft Knowledge Base article 49500, List of antivirus software vendors.
Note If you determine that the software you are using is not compatible with Exchange Server 2003, disable the antivirus software on the server, and then restart the Information Store Service.

Make sure that you have correctly removed any antivirus software that you currently are not using. Contact your antivirus program vendor for information about how to correctly remove the antivirus program.

Make sure that you have correctly installed the antivirus software that you currently are using. Contact your antivirus program vendor if you have any questions about correct installation of the antivirus program.
For a general overview of antivirus support in Exchange Server 2003, see Microsoft Knowledge Base article 823166, Overview of Exchange Server 2003 and antivirus software.

Version: 6.5.6940.0
Component: Microsoft Exchange Information Store
Message: Error code error code returned from virus scanner initialization routine. Virus scanner was not loaded.

Explanation
This Error event is typically logged in one of the following conditions:

When you are using antivirus software that is not compatible with Exchange Server 2003.

When you have an antivirus program installed and the antivirus program is damaged. An antivirus program can be damaged for one or more of the following reasons:

You reinstall or restore Exchange Server from backup, but you do not reinstall the antivirus program.

You remove the antivirus program, but the removal of the program is incomplete or damaged.
Event 9581 may appear during upgrades from Exchange 2000 Server to Exchange Server 2003 or during the installation of Service Pack 2 on an Exchange 2000 server. The error code provided in event 9581 may help you discover the underlying cause. The two most common error codes seen in event 9581 are error code -2147221232 and Error code -1.

MSExchangeIS Error event 9564 may be logged with event 9581. Event 9564 indicates that the Microsoft Information Store Service was not able to start. Two of the common error codes seen in event 9564 are 0x80040110 and 0x3ee.

User Action
To resolve this issue, try one or more of the following:

Make sure that the antivirus software you are using is compatible with Exchange Server 2003. Contact your antivirus vendor to determine which version of antivirus software is compatible with Exchange Server 2003. For details, see Microsoft Knowledge Base article 49500, List of antivirus software vendors.
Note If you determine that the software you are using is not compatible with Exchange Server 2003, disable the antivirus software on the server, and then restart the Information Store Service.

Make sure that you have correctly removed any antivirus software that you currently are not using. Contact your antivirus program vendor for information about how to correctly remove the antivirus program.

Make sure that you have correctly installed the antivirus software that you currently are using. Contact your antivirus program vendor if you have any questions about correct installation of the antivirus program.
For a general overview of antivirus support in Exchange Server 2003, see Microsoft Knowledge Base article 823166, Overview of Exchange Server 2003 and antivirus software.

15

since i exceed the forums posting character limit a new message continueing previous posting:

Details Product: Exchange ID: 9564 Source: MSExchangeIS Version: 8.0 Symbolic Name: msgidStartServer Message: Error %1 starting the Microsoft Exchange Information Store. %2.

Explanation
This Error event indicates that one or more databases on the server running Microsoft Exchange Server could not start. The event description contains extended information about the failure. Other related events may provide more specific information.

User Action
To resolve this error, do the following:

Review related Error and Warning events in the Application log. These related events may help you find the root cause of this error.

For more information, search for the error code specified in the event description on Search the Support Knowledge Base (KB).

Note If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Version: 6.5.6940.0
Component: Microsoft Exchange Information Store
Message: Error starting the Microsoft Exchange Information Store.
.

Explanation
Error starting the Microsoft Exchange Information Store service.

User Action
Check the event log on the server for more information. This behavior can occur when you have an antivirus program installed and the antivirus program is damaged. This can occur for one or more of the following reasons:

You reinstall or restore Exchange Server from backup, but you do not reinstall the antivirus program.
You remove the antivirus program, but the removal of the program is incomplete or damaged.

16

Hello WPN,

Thanks for checking - that sounds exactly my problem…
Any news from the Avast crew ?

Cheers,
Mario

17

well im gonna join you in the problem of having avast installed with plugins for certain services

i had to update my mail server today so i did all succesful… no problem there

then i removed my expired AV solution (tho it was still updating itself) called… Mc… u know…

i made a package for the server, had the exchange 2003 plugin in there and the ISA plugin (since ISA runs on that server too)

i reboot…

and well actually i wasnt surprised to see that my exchange didnt come up anymore, i saw a lot of errors passing by for ISA too
but since i was working already from 8am i didnt check in there yet (the time i saw the errors it was 10:15pm and the only break i had was getting food for dinner)

i changed the registry key like i mentioned myself earlier in this thread, and did a reboot
no success so i removed avast with the uninstaller and the exchange service still didnt come online automaticly but it did manually
i stubornly did reinstall avast but without the exchange and isa plugins (actually creating the same situation as it was with the other AV) and rebooted… still no automatic starting BUT i did get exchange started manually again…
so until this server is either upgraded again with avast 5 and better working plugins i have to keep in mind to start the services myself everytime the server reboots… (tho i hope this will not happen until I say it has to happen which wont be often really)

i will look into the logfiles friday or so when i actually have time for checkign the logs

18

I see that you ran the avast uninstall tool, but it doesn’t seem like you ran the McAfee removal tool.

I haven’t seen ANY problem on 2000 or 2003 servers with avast (a different story with 2008 SBS), but by making sure that all of McAfee has been removed, it will be a good start.

19

well if u send me a link to a free removal tool i will gladly run it :slight_smile:

but…
besides that i have done several installations in virtual test enviroments now with a complete clean install and exchange crashes a lot of the times, more then it does not crash…

i believe Alwil have to do their best with the next plugin release to have a better integration nomather what av solution used to be installed before that… (the key is supposed to be in registry settings for exchange, so during install it can be scanned and reported to give trouble or possibly give a sollution or solve it for itself even)

ive seen too much threads with this problem already… must be a signal to the devteam that it needs some work…

20

Well, in regards to McAfee, I used to have this installed on every machine in the school and parish that I work for. I hated it (as did many other users) and as soon as their license had expired, I of course purchased Avast.

Even after running the removal program from their (I don’t even remember the program’s name now) but their equivalent to ADNM, I still had to run the McAfee removal tool on all computers because even though the program was gone, the processes still ran on every computer on the campus.

The removal tool can be obtained from here: http://majorgeeks.com/McAfee_Consumer_Product_Removal_Tool_d5420.htmlhttp://majorgeeks.com/McAfee_Consumer_Product_Removal_Tool_d5420.html

or do a search on google for mcafee removal tool, just be careful from where you download it from.

Their own site should be safe though: http://service.mcafee.com/FAQDocument.aspx?id=TS100507