The service failed to load TransportScan module

[humph]

Hi All,

I'm Running Exchange 2003 SP2 with Virusscan Enterprise 8.8.0 (8.8.0.849) and  MSME 7.6.7718.105 and every 10 minutes i get a Notification (see below)

The service failed to load TransportScan module

1. Restart the service.

2. Restart the McAfee Security for Microsoft Exchange service.

3. Check whether the processes SAFeService.exe, RPCServ.exe, and postgres.exe are started.

4. Check the Windows event log for more details.

5. Please contact McAfee Technical Support.

I checked the SAFeService.exe, RPCServ.exe and Postres.exe and they are all started and running,  when i open the product configuration for the MSME and look in the  "Recently Scanned Items" i see the emails are being scanned... but i dont know what is triggering the notification.

Also when i go to Windows Event Viewer i see alot of PostgreSQL Warning Messages (see below)

The description for Event ID ( 0 ) in Source ( PostgreSQL ) cannot be found.

The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details.

The following information is part of the event: WARNING:  pgstat wait timeout

I started getting these messages after i ran the VSE 6807 & 6808 DAT Integrity Reporter on my Server/Computers and it reported that i should install VSE 8.8 Hotfix 793640

See Here https://community.mcafee.com/docs/DOC-4124  and Here https://kc.mcafee.com/corporate/index?page=content&id=KB76004

The Server was working ok up until i installed the Hotfix on the Server.

How do i troubleshoot this and am i at the right place for this problem..

Any Help Appreciated

[tlange]

is there any mcafee error in the app log around the time the notification is getting sent?  Do you have patch1 for msme 7.6 installed?  if not i would get that installed. 

is this server strictly a mailbox server.  if so then i would turn off the transport scanning and just use the vsapi scanning.

[humph]

The Server does both Roles and its only used for internal (local) emails.

I'm Not seeing any errors in the app logs

Just checked my product information and it says

Product Version - 7.6.7718.105

Service Pack - none

Hotfixes - Patch1

Buffer Overflow Protection - Installed

What do u reccomend i do ?

Where do i go from here

Message was edited by: humph on 8/28/12 3:08:57 PM CDT

[tlange]

patch1 is installed so you don't need to worry about that.  if the server isn't doing spam scanning then i would disable the transport scanning and just do vsapi scanning.   with the setup you are talking about there really isn't a need to have transport scanning enabled.

[humph]

Thanks for the feedback

The Server is not doing spam scanning,

Where do i disable transport scanning ?

Do i disable it  via Windows or on  EPO  Server (pardon me if my ques seems stupid i just want to be  very sure of what i'm doing)

[tlange]

open the msme gui and click on settings and diagnostics.  this will bring up the on access settings page

at the bottome of the right hand page it will say transport scan settings.  just uncheck the enable: box.

[humph]

Ok Thanks

I will try that and report back in a couple of days

[alexn]

These errors can be safely ignored because they do not signify an actual problem.

You can also try this solution as well

First of all do the following:

Exclude this process "safeservice.exe" in VSE Access Protection Exclusion list

1.Click Start, Programs, McAfee, VirusScan Console.   

2.Right-click Access Protection, and select Properties

3.Select Common Standard Protection.

4.Double-click Prevent modification of McAfee files and settings

5.under Processes to exclude, navigate to the end of the list.

NOTE: You might have to move some way down with your cursor.
   
6.Type a comma, then safeservice.exe, then click OK.

Close the VirusScan Console

Second Solution:

You can Recreat Postgress Database.

1. Go to  service(s) and select Stop:McAfee Security for Microsoft Exchange service.
   
2. After the service has stopped, click Start, Run, type taskmgr, then click OK.
3. Click the Processes tab.
4. Ensure that none of the following processes are still loaded:
      
   
   • Safeservice.exe
   • RPCServ.exe (there may be multiple instances of these)
   • Postgres.exe

  NOTE: If any of these processes are visible after the service has stopped, select the process and click End Process. These are known as orphaned processes. Orphaned processes can be ended without causing any issues.

1.Click Start, Run, type %AllUsersProfile%\McAfee\MSME\Data and click OK.

    NOTE: If you use a different location for the database, type that folder name instead.

2.Rename the MSMEData folder. If the database is no longer required, you can delete this folder instead of renaming it.

At this point, the Security for Exchange service restarts, and the MSMEData folder is automatically recreated.

To start a Windows service

1. Click Start, Run, type services.msc and then click OK.
2. From the list, right-click the following service(s) and select Start:

McAfee Security for Microsoft Exchange

3. Ensure that a new MSMEData folder is created.
4. Confirm that items can be quarantined and viewed.

If the issue persists, proceed to the next solution. Download MSME 7.6 patch 2 HF718833 and and run the setup it will upgrade Posgress Database version and fix this obnoxious error messages.

Message was edited by: alexn on 8/28/12 4:04:18 PM CDT

Message was edited by: alexn on 8/28/12 4:07:01 PM CDT

Message was edited by: alexn on 8/29/12 8:18:55 AM CDT

[aus_mick]

Humph,

We had a similar issue. After installating both Patch 1 and Rollup 2 we were still expering the 'pgstat wait timeout' error. I ended up finding a thread on the PostgresSQL Wiki (here) which suggested the OS AV as the root cause. Paraphrasing the article it suggested that Postgres seems to trigger a race condition/bug in a lot of AV products relating to file access interception where multiple processes are trying to access the same files all the time and in effect causing a denial of access as it were.

Depending on how relaxed your security policies I found that either adding the postgres.exe as a low risk process or alternatively adding scan exclusions for the folders containing the PostgresSQL binaries and the database seemed to resolve this issue for us. I hope that it serves you well.

Regards,

Mick

[humph]

Hey aus_mick

Thanks for the write up, your post  might come in handy when i'm migrating/ugrading my Exchange Server in the future.

I fixed my issue by disabling the transport scanning and just do vsapi scanning since my server only does internal (.local) mails.

Thanks much again.