Real-time scan operations time out when Forefront Security for SharePoint tries to scan small files

On a computer that is running Microsoft Forefront Security for SharePoint, you may experience the following symptoms:

• Real-time scan operations time out when Forefront Security for SharePoint scans small files.
• The following error information may be logged in the ProgramLog.txt file:

  • ( 8156- 3384), ERROR: The system cannot find the file specified
     The following information is part of the event; Pathway Net Application.aspx
    ( 8156- 7760), INFORMATION: sybarispvsapi.cpp::CSybariSPVsapi::Initialize(): Initialize SPVSAPI in c:\windows\system32\inetsrv\w3wp.exe process

  • ( 6108- 4528), ERROR: SharePoint Realtime scan exceeded the allowed scan time limit.
    
    ( 8156- 3744), ERROR: Failed to load EventStrings-en_us.dll
    ( 8156- 3744), ERROR: The system cannot find the file specified.

  By default, the ProgramLog.txt file is located in the %ProgramFiles%\Microsoft Forefront Security\SharePoint folder.

This problem occurs if the following conditions are true:

• Forefront Security for SharePoint tries to scan a file that is not a container file.
• One of the following issues occurs:
  • The scan operation takes longer than the time-out value in Forefront Security for SharePoint.
    
    Note By default, the time-out value is 10 minutes.
  • The scan operation returns a result of RPC_E_SERVERFAULT or STATUS_ACCESS_VIOLATION.

When this problem occurs, the SharePoint Virus Scanning API (VSAPI) hook cannot load the EventStrings.dll file. This behavior occurs because the SharePoint VSAPI tries to locate the EventStrings.dll file in the location from which the W3wp scan process is running. Instead, the SharePoint VSAPI should try to locate the EventStrings.dll file in the Forefront Security for SharePoint installation folder.

How to obtain the hotfix

This issue is fixed in the Microsoft Forefront Security for SharePoint Service Pack 1 Rollup 1 Hotfix Package that was released December 20, 2007. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.