Real-time scan operations time out, and event IDs 2054 and 28721 are logged on a computer that is running Forefront Security for SharePoint

On a computer that is running Microsoft Forefront Security for SharePoint, you experience the following symptoms:

• Real-time scan operations time out. When this problem occurs, you receive the following error messages.
  
  Error message 1
  960013: Antivirus scanner timed out.
  Error message 2
  GetSPAVSettingScanTimeout 0x80020009.
• The following error information may be logged in the ProgramLog.txt file:

  ERROR: The system cannot find the file specified.
   The following information is part of the event; Pathway Net Application.aspx
  
  ERROR: SharePoint Realtime scan exceeded the allowed scan time limit.
  
  ERROR: Failed to load EventStrings-en_us.dll
  ERROR: The system cannot find the file specified.
  ERROR: GetSPAVSettingAttemptToClean 0x80020009
  ERROR: GetSPAVSettingAttemptToClean 0x80020009
  ERROR: GetSPAVSettingScanTimeout 0x80020009
  ERROR: GetSPAVSettingScanTimeout 0x80020009
  ERROR: GetSPAVSettingAttemptToClean 0x80020009

  By default, this file is located in the %ProgramFiles%\Microsoft Forefront Security\SharePoint folder.
• The following events may be logged in the Application event log.
  
  Event ID 2054

  Event Type: Error
  Event Source: FSSPController
  Event Category: (2)
  Event ID: 2054
  Date: date
  Time: time
  User: N/A
  Computer: ComputerName
  Description: The description for Event ID ( 2054 ) in Source ( FSSPController ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: UKFlag.gif.

  Event ID 28721

  Event Type: Error
  Event Source: Windows SharePoint Services 3
  Event Category: (1105)
  Event ID: 2054
  Date: date
  Time: time
  User: N/A
  Computer: ComputerName
  Description: The description for Event ID ( 28721 ) in Source ( Windows SharePoint Services 3 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: #960013: Antivirus scanner timed out.

This problem occurs if the SharePoint Virus Scanning API (VSAPI) hook tries to load the EventStrings.dll file incorrectly. In this scenario, Forefront Security for SharePoint cannot load the EventStrings.dll file successfully. Therefore, the scanning operation is unsuccessful.

How to obtain the hotfix

This issue is fixed in the Microsoft Forefront Security for SharePoint Service Pack 1 Rollup 1 Hotfix Package that was released December 20, 2007. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.