locked
Error Code: 0x8050800c RRS feed

  • Question

  • Hi.  We are experiencing the error outlined in this thread below, only since the client computers have been upgraded to windows 7 via fresh install.  They are running the latest updates for Forefront yet are continually reporting this error.  I thought I would try a new post to see if I get a reply?  Several hundred computers are reporting this error daily.  Any help is appreciated.

    http://social.technet.microsoft.com/Forums/en/Forefrontclientgeneral/thread/38949f9e-efe2-453b-8dfa-10bec2535e9b

    Microsoft Forefront Client Security scan has encountered an error and terminated.
    Scan ID: {7E637A84-D110-4827-88A3-9478BDD72CDA}
    Scan Type: AntiMalware
    Scan Parameters: Quick Scan
    User: NT AUTHORITY\NETWORK SERVICE
    Error Code: 0x8050800c
    Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support

     

    Operating System Version
    6.1.7600
    Virus Definitions Version
    1.89.572.0 (Virus Definitions built on 29/08/2010 7:57:23 PM)
    Spyware Definitions Version
    1.89.572.0 (Spyware Definitions built on 29/08/2010 7:57:23 PM)
    Antimalware Engine Version
    1.1.6103.0
    Security State Assessment Engine Version
    1.0.1710.103
    Security State Assessment Definitions Version
    1.0.1710.103
    Antimalware Service Version
    1.5.1981.0
    Security State Assessment Service Version
    1.0.1703.0
    Policy Name
    Default Policy
    Policy Last Updated
    15/06/2010 10:03:14 AM
    Last Heartbeat
    30/08/2010 8:12:39 AM
    Last Malware Scan
    24/08/2010 9:34:42 PM
    Last Security State Assessment Scan
    29/08/2010 10:14:17 AM

    Sunday, August 29, 2010 10:43 PM

Answers

  • Hi,

    Thanks for the post.

    This issue may occur if  the ProfileList key contains subkeys which do not have a ProfileImagePath value.

    At this point, please perform the following steps to troubleshoot it:

    1. Launch regedit
    2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
    3. Expand each subkey
    4. In the right pane, if there is no ProfileImagePath, choose New > Expandable string value
    5. Name the value ProfileImagePath

    • You can leave the value blank

    6. Close regedit
    7. Restart the FCS antimalware service

    • Net stop fcsam
    • Net start fcsam

    Note: Please backup the registry before modifying any value.

    Does it work?

    Hope this helps.

    Miles


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Nick Gu - MSFT Tuesday, September 7, 2010 5:41 AM
    Monday, August 30, 2010 7:33 AM
  • Hi guys,

     

    I believe we have a solution for our issue- or at least a workaround.

    Have your affected machines got CDs in the optical drives? Seems this is happening because Forefront is detecting an error within the autoruns on CDs and removable media.

    If you remove the CD from the drive on an affected machine, or run a custom scan omitting the optical drive or removable media, it works fine on our machines.

     

    Microsoft are apparently trying to work on a fix right now.

    Dave

    • Marked as answer by Nick Gu - MSFT Tuesday, September 7, 2010 5:41 AM
    Wednesday, September 1, 2010 7:37 AM

All replies

  • Hi,

    Thanks for the post.

    This issue may occur if  the ProfileList key contains subkeys which do not have a ProfileImagePath value.

    At this point, please perform the following steps to troubleshoot it:

    1. Launch regedit
    2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
    3. Expand each subkey
    4. In the right pane, if there is no ProfileImagePath, choose New > Expandable string value
    5. Name the value ProfileImagePath

    • You can leave the value blank

    6. Close regedit
    7. Restart the FCS antimalware service

    • Net stop fcsam
    • Net start fcsam

    Note: Please backup the registry before modifying any value.

    Does it work?

    Hope this helps.

    Miles


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Nick Gu - MSFT Tuesday, September 7, 2010 5:41 AM
    Monday, August 30, 2010 7:33 AM
  • Hi,

    I am also having this issue as of Sunday (30/08/10), only affecting Server 2003.


    Miles Zhang's fix above does not work for me, all profiles have the ProfileImagePath value.

    Is one of the new definition files causing an issue?

    Regards

    Dave

    Tuesday, August 31, 2010 8:15 AM
  • Hi Miles. 

    Sorry for the delay.  All profiles have the ProfileImagePath value so this is not the cause. Something else noted is that this problem seems to be intermittant on individual computers, e.g. some days certain computers report the error, then the next they do not, but others do, then the next day some of the computers from the first day will report it again, in combination with some from the previous day and some new ones.  We have about 700 computers and seem to be getting about 100 reporting errors per day.  All running windows 7 Pro, latest definitions, engines, ect.  Problem was not occuring on the computers when they were running XP SP3 Pro.

    Dave, is this the same for you?

    Matt

    Tuesday, August 31, 2010 10:12 PM
  • Hi guys,

     

    I believe we have a solution for our issue- or at least a workaround.

    Have your affected machines got CDs in the optical drives? Seems this is happening because Forefront is detecting an error within the autoruns on CDs and removable media.

    If you remove the CD from the drive on an affected machine, or run a custom scan omitting the optical drive or removable media, it works fine on our machines.

     

    Microsoft are apparently trying to work on a fix right now.

    Dave

    • Marked as answer by Nick Gu - MSFT Tuesday, September 7, 2010 5:41 AM
    Wednesday, September 1, 2010 7:37 AM
  • YES!, CD's, DVD's but more often than not, USB Flash Drives.  That would explain the randomness. Has MS published info on this problem/fix?  Can you post a link so I can follow it's status?  We will not be able to prevent our users from inserting USB Flash drives as it is a part of every-day practice here and we would like to have them scanned.

    Matt

    Wednesday, September 1, 2010 10:08 PM
  • We have recieved no documentation or anything, this is just from research we have done and testing. We have logged a call with Microsoft to see if they have a solution or a fix coming out, but it's been quite a few days now...

    I suppose you could try excluding autorun.exe from your scans to see if this fixes it, I don't want to try it out in our live environment really.

     

    Any of the Technet guys here able to shed any light on how long this might take to resolve?

     

    Cheers

    Dave

    Thursday, September 2, 2010 11:19 AM