FSCController error event ID 8046 VirusBuster scan engine is now obsolete
-
Monday, October 08, 2012 5:37 PMHow do I stop these errors showing in the Windows event viewer. I have turned off all the Virusbuster scans in Forefront but am still receiving these errors in the event viewer. I am running Forefront Version 10.20.0945.0 Service Pack 2.
All Replies
-
Monday, October 08, 2012 5:57 PM
Hi,
do the following steps: (http://support.microsoft.com/kb/2758276/en-us)
Forefront Server Security for Exchange and SharePoint:
Disable Updates: To disable engine updates, go to Settings and thenScanner Updates. Highlight the Virus Buster engine and hitDisable. Save.
Disable Scan: To disable Virus Buster scanning, go to Settingsand then Antivirus. Uncheck Virus Buster Antivirus Scan Engine underFile Scanners. You will also have to go to Operate and thenQuick Scan and uncheck the Virus Buster Antivirus Scan Engineunder File Scanners.Greetings
Christian
Christian Groebner MVP Forefront
-
Monday, October 08, 2012 6:11 PMI have performed those steps you mentioned but am still getting the Event Viewer error Event ID 8046 stating that the virus buster scan engine is obsolete.
-
Monday, October 08, 2012 6:19 PM
Hi,
check if the update for this engine is disabled and the engine is really removed from every scan job. Don't forget so save the settings after you have changed them.
Greetings
Christian
Christian Groebner MVP Forefront
- Proposed As Answer by Nick Gu - MSFTMicrosoft Contingent Staff, Moderator Thursday, October 11, 2012 3:02 AM
- Marked As Answer by Nick Gu - MSFTMicrosoft Contingent Staff, Moderator Monday, October 15, 2012 2:12 AM
-
Friday, October 19, 2012 6:24 PMWe've double and triple checked ONE of our exchange servers. The VirusBuster is disabled everywhere. We've rebooted the server and we STILL get these "Microsoft® Forefront Server Security Engine Notification" spams every night at 1AM on the dot from this Server. Disabling the engine went just fine according to the instructions with all other Exchange servers. HELP!!!
- Robert Buckmaster
-
Thursday, October 25, 2012 6:08 PM
We are experiencing the exact same thing on our edge server. All other Exchange servers stopped updating when the updates and engine was disabled, but not this one. Even when setting the update schedule to one time only, and then disabling, and saving, and rebooting, the update is still attempted and an error notification sent! The versions are consistent between our servers: 11.0.727.0
-
Thursday, October 25, 2012 6:50 PM
Hi,
have you disable the engine also in the jobs?
1. Disable Updates: To disable engine updates, go to Settings and thenScanner Updates. Highlight the Virus Buster engine and hitDisable. Save.
2. Disable Scan: To disable Virus Buster scanning, go to Settingsand thenAntivirus. Uncheck Virus Buster Antivirus Scan Engine underFile Scanners. You will also have to go toOperate and thenQuick Scan and uncheck theVirus Buster Antivirus Scan Engineunder File Scanners.Greetings
Christian
Christian Groebner MVP Forefront
-
Thursday, October 25, 2012 7:06 PM
I wonder HOW MANY TIMES we will be told these steps?? We've performed these steps. As stated, on 10 other Exchange Servers (exactly configured) this corrected the issue. On this ONE server, it has not. We've TRIPLE checked that VirusBuster is removed from all Scan Engines and Updates. We've rebooted the Server. We've flipped VirusBuster BACK ON in every area. Saved settings and then gone through and removed it again.
Still every day the emails come. What is the solution?
- Robert Buckmaster
-
Thursday, October 25, 2012 7:15 PM
Hi,
in your case you should open a case with Microsoft to fix this issue.
Greetings
Christian
Christian Groebner MVP Forefront
-
Thursday, October 25, 2012 8:20 PM
Hi,
I've found two things you can check. Open the FSE Management Shell and run the following commands:
Get-FseEngineManagementThe result should be something like this:
OverrideAutomaticManagement : True
OnDemandEngines : {MICROSOFT, KASPERSKY, NORMAN, AUTHENTIUM}
RealtimeEngines : {MICROSOFT, KASPERSKY, NORMAN, AUTHENTIUM}
ScheduledEngines : {MICROSOFT, KASPERSKY, NORMAN, AUTHENTIUM}
TransportEngines : {MICROSOFT, KASPERSKY, NORMAN, AUTHENTIUM}get-FseSignatureUpdate | ft Engine,EnableSchedule
Here the output should be something like this:
Engine EnableSchedule
------ --------------
NORMAN True
MICROSOFT True
AUTHENTIUM True
WORMLIST True
VIRUSBUSTER False
KASPERSKY True
CLOUDMARK FalseCan you post your results here?
Greetings
Christian
Christian Groebner MVP Forefront
Christian Groebner MVP Forefront
-
Monday, October 29, 2012 5:40 PM
I regret to report that I am unable to launch FSE Mgmt Shell. This is Forefront Security for Exchange v10 SP2, with Hotfix Rollup 3. I don't see a Shortcut to launch Powershell with FSE AddIn. I do see it on our Exchange 2010 systems with FPE v11. I did try an
"Add-PsSnapin FSSPSSnapin" from Powershell and got an: Add-PSSnapin : Windows PowerShell snap-in FSSPSSnapin is not installed on the machine.Please advise.. you sure there was a FSE Mgmt Shell with version 10?
- Robert Buckmaster
-
Wednesday, October 31, 2012 1:11 PMIn the Forefront Security Administrator SETTINGS\Antivirus, I'm sure you uncheck the VirusBuster Scan Engine for the Realtime Scan Job, but did you also unckeck the VirusBuster Scan Engine for the Manual Scan Job and also the Realtime and Manual templates?
Stephen Littlehale
-
Wednesday, October 31, 2012 8:19 PM
Yes, it's de-selected from all three Scan Jobs in the Settings -> Antivirus section. Now you mentioned "templates". So, I went down to the Templates section of Settings and there I have the 3 Scan Jobs listed again (Transport, Realtime and Manual) but with no modifiable attributes beyond the Template dropdown, where I can choose Default and then click Load from Template. Now, I noticed if I do that, and then go back to Antivirus the VirusBuster engine is checked again.
So how do I modify the Templates?
I also should note that the VirusBuster option has VANISHED from all of my other Servers. As if it never existed..
- Robert Buckmaster
-
Wednesday, October 31, 2012 9:03 PM You need to stay on SETTINGS\Antivirus and click "file" (upper left) then "Templates" then click on "View Templates". All the templates should now be listed and they probably have VirusBuster checked. You will need to go to each template, remove the check mark and then save the template. Once that is done, you may need to restart the FSCController, but once the the templates are updated the "VirusBuster" engine should vanish and the email notifications should stop. Let me know if that works for you.
Stephen Littlehale
- Proposed As Answer by TWIT Nerd Tuesday, November 20, 2012 1:02 AM
-
Wednesday, October 31, 2012 9:46 PMahh excellent, yes thank you for that, convenient little place for them to hide. Interesting we didn't have to do this with any other of the Exchange Servers w/FSE. OK - I've made this change. I can't cycle the FSCController service as it's a production server. but if we get the spam again tonight then I'll schedule a reboot. So.. crossing fingers, thanks again.
- Robert Buckmaster
-
Thursday, November 01, 2012 1:07 PM
Robert, You may not need to cycle the controller at all. I found out one more place that VirusBuster was checked and as soon as I unchecked it and then closed and re-opened the Forefront Security Administrator, the VirusBuster Scan Engine vanished and the email notifications stopped. You need to go to OPERATE\Quick Scan. Look on the right for the File scanners. Make sure VirusBuster is Unchecked. Close and re-open the ForeFrone Security Administrator. Is VirusBuster gone?
Stephen Littlehale
- Proposed As Answer by swlittlehale Thursday, November 01, 2012 1:10 PM
-
Thursday, November 01, 2012 4:06 PM
We found the Operate -> Quick Scan location earlier on and this was the key to our other Exchange Servers. The VBuster engine still appears in my Forefront Mgmt Console, even after the Templates revelation.. Our 1AM reward:
The VirusBuster Antivirus Scan Engine scan engine is now obsolete and no longer supported. Updates are no longer available for this engine, and therefore the update check for this engine has been disabled. Please review the scan engines chosen for your scan jobs and make another selection to ensure up-to-date protection. For more information, see http://go.microsoft.com/fwlink/?LinkId=152864
On a side note, swlittlehale, do you have a shortcut or method to open the FSE Mgmt Powershell? I still am unable to perform the check that Christian Groebner requested earlier in the thread. Though it appears he's left me anyway..
- Robert Buckmaster
-
Thursday, November 01, 2012 4:57 PM
I have never tried using the management shell for ForeFront Security (didn't know it existed), only ForeFront protection 2010. Not sure if it would work, but did you try performing the “Add-PSSnapin FSSPSSnapin” from the Exchange management shell?
As far as the VirusBuster engine is concerned, as long as it is still listed as an scan engine option, you will still receive the notifications. Not sure if you saw this, but I found an article that describes three locations that need to be updated for the notifications to stop:
have all three locations been updated? If they have, have you tried going into the registry and deleting the vBuster scan engine key?
Stephen Littlehale
-
Thursday, November 01, 2012 5:16 PM
1) Yes, I tried the Add-PSSnapin command, no dice.
2) We did follow the steps in http://blogs.technet.com/b/fss/archive/2009/11/16/how-do-i-disable-these-engine-end-of-life-notifications-i-am-receiving-from-antigen-and-forefront.aspx verbatim.
3) If you mean the instructions in http://blogs.technet.com/b/dblanch/archive/2010/01/13/forefront-obsolete-notifications.aspx yes, we tried that as well. We changed our EngineList value from 8343 to 8143 (which drops VBuster). and the FSCController service would not start. We had to change it back. Additionally, the value is 8343 on all of our Exchange Server with FSE (even the ones where the VBuster item is gone from the Console).
- Robert Buckmaster
-
Monday, December 10, 2012 4:21 PMI don't understand having an Automatic management option if it doesn't automatically update. Setting the option to Manual in order to disable an engine that is being retired makes the automated management (one of the selling points of Forefront) useless.
.png)
