none
Kaspersky downloads but does not install. GetEngineFiles 6014 0x80004005 GetFileCommand "Error: 13. File exists" NOT a timeout.

    Question

  • Kaspersky downloads but does not install. GetEngineFiles 6014 0x80004005 GetFileCommand "Error: 13. File exists" NOT a timeout.

    Forefront Server Security
    Version: 10.2.0956.0
    Service Pack: 2

    Microsoft Forefront Hotfixes Installed:
     KB2420644
     KB2508148
     KB978297

    Exchange Version: 08.01.0399.000 Exchange IS Version: 8.1.392.0

    Operating System: Windows NT Version 6.0, Build number 6002
    Operating System Service Pack: Service Pack 2
    Processor: Intel processor
    Number of Processors: 8
    Total Physical Memory: 8578719 KBytes
    Available Physical Memory: 274563 KBytes

    GetEngineFiles 6014 10/5/2011 5:16:38 AM 24
    Event Details:   
    Microsoft Forefront Server Security encountered an error while performing a scan engine update. Scan Engine: Kaspersky5 Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Kaspersky5 Proxy Settings: Disabled Error Code: 0x80004005 Description: An error occurred while installing the scan engine.

    \Program Files (x86)\Microsoft Forefront Security\Exchange Server\Data\ProgramLog.txt shows:

    Wed Oct 05 07:05:01 2011 (14940- 3748), "INFORMATION: Attempting to download the Kaspersky5 scan engine package from http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Kaspersky5."
    Wed Oct 05 07:17:06 2011 (14940- 3748), "INFORMATION: The Kaspersky5 scan engine has been downloaded"
    Wed Oct 05 07:17:06 2011 ( 3780- 4208), "WARNING: realtimeproxy.cpp: DisableScanEngine(8000) returned an RPC error: 800706ba"
    Wed Oct 05 07:17:09 2011 (14940- 3748), "ERROR: UpdateException: GetFileCommand failed on Local Filename: kavbase.kdl Remote Filename: bases/kavbase.kdl.cab.  SybSync:UnzipFile CabException: Failed to extract the file(s) from 'C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server\Data\Engines\x86\Kaspersky5\Bin\bases/\syb7526.tmp': 11: User aborted. CAB is readable. 
    Failed to open 'C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server\Data\Engines\x86\Kaspersky5\Bin\bases/kavbase.kdl'. Error: 13. File exists. Attribs: 'RW'."
    Wed Oct 05 07:18:58 2011 (14940- 3748), "INFORMATION: The Kaspersky5 scan engine has been rolled back."
    Wed Oct 05 07:18:58 2011 ( 3780- 4208), "ERROR: The call to g_ppRealtimeProxies[0]->EnableScanEngine() from EnableScanEngines function failed and returned: 800706ba"
    Wed Oct 05 07:25:02 2011 (15204- 2100), "INFORMATION: Attempting to download the Norman scan engine package from http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Norman."
    Wed Oct 05 07:27:01 2011 (15204- 2100), "INFORMATION: The Norman scan engine has been downloaded"
    Wed Oct 05 07:27:04 2011 ( 3780- 4208), "WARNING: realtimeproxy.cpp: DisableScanEngine(1) returned an RPC error: 800706ba"
    Wed Oct 05 07:27:28 2011 (15204- 2100), "INFORMATION: The Norman scan engine has been staged."
    Wed Oct 05 07:27:31 2011 (  460-14888), "INFORMATION: Testing the Norman scan engine."
    Wed Oct 05 07:28:02 2011 (15204- 2100), "INFORMATION: The Norman scan engine has been installed."
    Wed Oct 05 07:28:47 2011 ( 3780- 4208), "ERROR: The call to g_ppRealtimeProxies[0]->EnableScanEngine() from EnableScanEngines function failed and returned: 800706ba"
    Wed Oct 05 07:28:49 2011 (15204- 2100), "INFORMATION: The Norman scan engine has been updated from http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Norman."
    

    It is interesting to me that the RPC error: 800706ba occurs for each of the engine updates, and doesn't seem to stop Norman and so on from completing.

    Seaching finds the following:
    http://support.microsoft.com/kb/924705 apparently quite old and not for Kaspersky and this is not a timeout error.

    http://www.kbalertz.com/967051/engines-cannot-update-Forefront-Security-Exchange-Server-extract-error-logged.aspx 

    http://support.microsoft.com/kb/967051

    old, and the hidden attribute is NOT set on
    \Program Files (x86)\Microsoft Forefront Security\Exchange Server\Data\Engines\x86\Kaspersky5\Bin\avekaspersky5.dll

    http://social.technet.microsoft.com/Forums/en-US/forefrontexchange/thread/f756628c-1454-43cb-9a89-674ca7928fb6/ Is very old, for a different version of OS and forefront, and a different engine, but the fix looks promising... if I don't hear any better ideas, I will try this.

    I've already had LOT's of experience with finding and solving errors on this... nice... server:
    http://techref.massmind.org/techref/os/win/2008sbs.htm#email :deep calming breaths: And I REALLY don't have time to deal with this right now. Any help would be VERY appreciated!

    Wednesday, October 05, 2011 5:23 PM

Answers

  • Apparently fixed. Under 
    \Program Files (x86)\Microsoft Forefront Security\Exchange Server\Data\Engines\x86\
    I renamed Kaspersky5 to Kaspersky5OLD (had to wait for one of the scheduled update attempts to finish before it would let me) and then manually updated. That appears to have succeeded and the engine is now showing version 8.1.8.79 update 111005008 as of 10/05/2011

    Not sure why the folder is still Kaspersky5 when the hotfix for the Kaspersky version 8 engine has been installed and the engine version shows as 8... I'm assuming they just reused the old folder?

    I also have no idea why this problem started happening a few days ago. I'm not seeing any errors related to the hard drive, nor have I seen other unusual errors recently. I'd love to hear if anyone else runs into this.

    • Marked as answer by James Newton Wednesday, October 05, 2011 8:25 PM
    Wednesday, October 05, 2011 8:25 PM