Archive for the ‘Antivirus’ Category

SharePoint File Upload Error Due to Symantec Protection Engine Service Failure

Friday, March 20th, 2015

Version: 1.0

Issue Summary

This has been a little tricky issue. Symantec Protection Engine (SPE) that is part of Symantec Protection for SharePoint Servers (SPSS) product has dependency on JAVA JRE component. A Java update caused the Symantec Protection Engine service on the SharePoint Server to fail. Service fails to start with Error 1053. That lead to file uploads in SharePoint to throw error.

Error Details

Symantec Protection Engine (SPE) component depends on Java JRE as you have to use the web browser to get to the Symantec Protection Engine Console. That web console is by default at this location on SharePoint Servers.

https://localhost:8004/

The issue started in this order:
a. A user was trying to upload a file to SharePoint and got the error
b. Symantec Protection Engine service on server was stopped and failed to start with Error 1053
c. Java update caused issue for the Symantec Protection Engine to fail

a. A user was trying to upload a file to SharePoint and got the error

The user received this error in browser.

Error Found
The installed virus scanner is currently unavailable. If the problem persists, contact your administrator.

SharePoint File Upload Error due to SharePoint Antivirus Failure
SharePoint File Upload Error due to SharePoint Antivirus Failure

b. Symantec Protection Engine service on server was stopped and failed to start with Error 1053

Looking at the Symantec Protection Engine (SPE) service under Windows Service console on SharePoint showed the service as stopped. When I tried to start the service, I got following error:

Error:
Windows could not start the Symantec Protection Engine service on local Computer.
Error 1053: The service did not respond to the start or control request in a timely fashion.

SharePoint Server - Symantec Protection engine service stopped and failed to start with error 1053
SharePoint Server – Symantec Protection engine service stopped and failed to start with error 1053

Following errors were logged in Event View log.

Error 1
Log Name:      System
Source:        Service Control Manager
Date:          2/05/2015 2:17:10 PM
Event ID:      7000
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SPAppServer01.svlab.com
Description:
The Symantec Protection Engine service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Service Control Manager” Guid=”{69908d1-a6d7-4795-8e1e-26931d2012f4}” EventSourceName=”Service Control Manager” />
    <EventID Qualifiers=”49152″>7000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime=”2015-02-26T15:17:10.310766100Z” />
    <EventRecordID>187359</EventRecordID>
    <Correlation />
    <Execution ProcessID=”580″ ThreadID=”5204″ />
    <Channel>System</Channel>
    <Computer>SPAppServer01.svlab.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name=”param1″>Symantec Protection Engine</Data>
    <Data Name=”param2″>%%1053</Data>
  </EventData>
</Event>

Error 2
Log Name:      Application
Source:        Application Error
Date:          2/05/2015 2:17:10 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SPAppServer01.svlab.com
Description:
Faulting application name: symcscan.exe, version: 7.0.2.4, time stamp: 0x5167b609
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0xf38
Faulting application start time: 0x01d051d7416d9dad
Faulting application path: C:Program Files (x86)SymantecScan Enginesymcscan.exe
Faulting module path: unknown
Report Id: 88260445-bdca-11e4-91bc-0050569300d1
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Application Error” />
    <EventID Qualifiers=”0″>1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=”2015-02-26T15:17:10.000000000Z” />
    <EventRecordID>331301</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SPAppServer01.svlab.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>symcscan.exe</Data>
    <Data>7.0.2.4</Data>
    <Data>5167b609</Data>
    <Data>unknown</Data>
    <Data>0.0.0.0</Data>
    <Data>00000000</Data>
    <Data>c0000005</Data>
    <Data>00000000</Data>
    <Data>f38</Data>
    <Data>01d051d7416d9dad</Data>
    <Data>C:Program Files (x86)SymantecScan Enginesymcscan.exe</Data>
    <Data>unknown</Data>
    <Data>88140445-bdca-11e4-91bc-0050569300d1</Data>
  </EventData>
</Event>

c. Java update caused issue for the Symantec Protection Engine to fail

It turned out to be that the last Java update that updated the Java JRE from some 7.x version to 8.x version caused the issue. After seeing the service failure error and reading Symantec KB articles, I removed and tried to redeploy Symantec Protection Engine component. I got the following error during SPE’s redeployment:

Error:
The Java Runtime Environment could not be found.
Please install the java runtime, 1.5 family, preferably build 13 or higher.

SharePoint File Upload Failure - Symantec Protection Engine re-installation error for Java JRE
SharePoint File Upload Failure – Symantec Protection Engine re-installation error for Java JRE

Keep reading the next section for the resolution.

Resolution

I removed the Java JRE version, rebooted the server and then installed a version from 7.x series 7u60. After that I was able to re-install Symantec Protection Engine. The re-installation fixed the service issue as well.

Make sure you review the Symantec KB resources listed below. In my case just removing version 8.x java and putting back the 7.x would have fixed the issue without re-installation of Symantec Protection Engine.

References

Keywords:

  • SharePoint File Upload error
  • SharePoint File Upload error due to antivirus failure
  • Symantec Protection engine service fails to start with error 1053
www.Softvative.com
Visit www.softvative.com for professional services.

Symantec Antivirus for SharePoint Blocked Linked Excel Files

Wednesday, October 8th, 2014

Symantec Protection for SharePoint Blocked Linked Excel Files

Issue Summary

Symantec Protection for SharePoint Servers (SPSS) 6.0 was deployed in the SharePoint farm. After deployment, certain files are getting blocked by it even though Symantec Antivirus on desktop had cleared those as clean files.

In one of my previous post Linked Excel Files and SharePoint, I covered the details on how linked files work in SharePoint.

Error:

2 – The file: FileNameByFM.xlsx -contains Unscannable Content. Reason: Container Size Violation | Container Size Violation -Status: Blocked

This file cannot be saved to the document library. If you want to save this file to the document library, clean the file using alternative virus scanning software and try saving it again.

Troubleshoot issues with Microsoft SharePoint Foundation.

File can not be uploaded to SharePoint dueto Symantec Antivirus for SharePoint SPSS
File can not be uploaded to SharePoint dueto Symantec Antivirus for SharePoint SPSS

If you are trying to upload a new file, the file is not uploaded. If you are trying to save after edit / checking out, file, it doesn’t work either.

Cause:

The issue is due to the linked MS Excel files that were on user desktop. Only container file was uploaded to the SharePoint. The file was 25 MB in size.

How to find linked files in MS Excel

Follow the steps listed below to find the linked files:
1. Open the Microsoft Excel file from SharePoint
2. Go to Data ribbon tab and then click Edit Links under Connections group
3. Review the linked file(s) for Location. Update / remove as it applies to your container file
4. Save and close the file

Microsoft Excel - Edit Linked Files
Microsoft Excel – Edit Linked Files

You might have to do these step by downloading a copy of that file on your desktop and then make above changes.

Microsoft Excel - Edit Linked Files - Review Location
Microsoft Excel – Edit Linked Files – Review Location

Resolution:

Even removing the linked file didn’t help in this case. The linked file was unnecessary in this scenario. Symantec Protection for SharePoint was still treating that file as a container file. Make sure you review the data in container Excel file that might be coming from the linked file.

I found that Symantec Protection Engine portal on the SharePoint server (http://localhost:8004) has a default filter policy for container handling. Symantec Protection Engine is a separate component of Symantec Protection for SharePoint Servers.

Container File Processing Limits:
Following filter policies were defined by default.

Stop processing a container file when any of the following limits is met or exceeded.
a. Time to extract file meets or exceeds: 180 seconds
b. Maximum extract size of the file meets or exceeds: 100 MB
c. Maximum extract depth of the file meets or exceeds: 10 levels

When processor limit is met or exceeded: Deny access to the file and generate a log entry.

Symantec Protection for SharePoint Servers - Filtering Policies on Container Handling
Symantec Protection for SharePoint Servers – Filtering Policies on Container Handling

I changed the container file  policy to: Allow access to the file and generate a log entry.

That seemed to resolve the issue.

Risk Assessment:

In this scenario, due to internal only SharePoint, the decision was made to allow access to files in case of container file processing limits are reached or exceeded. The decision was in favor of application availability rather strict security.

Keywords:

  • Symantec Antivirus for SharePoint
  • Symantec Protection for SharePoint
  • Symantec Protection for SharePoint blocks file
  • Symantec Protection for SharePoint does not allow file upload
  • Symantec Protection blocks file upload in SharePoint
  • File upload blocked by Symantec antivirus
  • File upload blocked in SharePoint
  • Unscannable Contents in SharePoint
  • Container Size violation in SharePoint
  • SharePoint File upload blocked by antivirus

Symantec Antivirus for SharePoint Doesn’t Allow File Upload

Friday, May 16th, 2014

Scenario:

A user tries to upload a file to a SharePoint document library and get the following error message:
The installed virus scanner is currently unavailable. If the problem persists, contact your administrator.
Symantec Antivirus for SharePoint causing Upload Error – The installed virus scanner is currently unavailable

Cause:

Symantec Antivirus for SharePoint has two components. Console and Protection Engine. Symantec Protection Engine if disabled or not running, can prevent users from uploading files to SharePoint. That behavior is triggered by the default configuration settings of the Symantec Antivirus for SharePoint. Notably under ‘Real-Time scan Settings‘ area within SharePoint Central Administration site.
Symantec Antivirus for SharePoint – Real-Time Scan Settings – Default

Resolution:

Make sure to allow the Bypass configurations in cases where Protection Engine is disabled / offline.
Steps:
1. Go to Central Administration home
2. Click on ‘Real-time Scan Settings’ under ‘Symantec Protection 6.0 for SharePoint Servers’ section.
Symantec Antivirus for SharePoint – On Central Admin Site Home
3. Enable these settings by configuring the check boxes:
   a. Bypass scanning when all Symantec Protection Engines are busy or offline 
   b. Bypass scanning when all Symantec Protection Engines are disabled
   c. Scan all content that was bypassed when all Symantec Protection Engines were offline or busy
The first two (a and b) settings will allow the users to upload files even when Symantec Protection Engines are busy, Offline or disabled. The third c setting will scan the files that were bypassed when Protection engine was offline or busy.
Symantec Antivirus for SharePoint – Real-Time Scan Settings – Revised
4. Click Save button at the bottom
After saving these configuration changes, the users should be able to upload files.
Symantec Antivirus for SharePoint – Allowed the File Upload after Revised Settings

Security Risk:

There is security risk there though. Doing so will allow users without Antivirus to upload infected files to SharePoint. That will be a major risk for internet facing deployments. In my case it was a non-production SharePoint. Always weigh-in the pros and cons of productivity loss versus the security issue in some of these situations.
Few Related Search Terms:
Symantec Antivirus for SharePoint Doesn’t Allow File Upload
Upload failed when antivirus scanner is unavailable
Symantec Protection Engine failure stops the file upload in SharePoint