none
Recent Kaspersky engines fail to load with 0x800C0102

    Question

  • We are using Antigen 9.0 SP2 Rollup 4 on Exchange 2003. Since September 2nd, updates of the kaspersky engine have not been successful. Downloading and installing seems to be fine, however the updated engine fails to load. Our ProgramLog.txt shows the following errors:

    Wed Sep 28 06:23:46 2011 ( 5964- 4036), "INFORMATION: The Kaspersky scan engine for Antigen has been downloaded"

    Wed Sep 28 06:24:23 2011 ( 5964- 4036), "INFORMATION: The Kaspersky scan engine for Antigen has been staged."

    Wed Sep 28 06:24:24 2011 ( 5540- 5992), "INFORMATION: Testing the Kaspersky scan engine."

    Wed Sep 28 06:24:50 2011 ( 5540- 5992), "ERROR: Unable to load the Kaspersky scan engine. hr = 0x800C0102.  An error occurred while loading the Kaspersky scan engine."

    Wed Sep 28 06:24:50 2011 ( 5964- 4036), "ERROR: The Kaspersky scan engine test failed. hr = 0x80004005"

    Wed Sep 28 06:25:04 2011 ( 5964- 4036), "INFORMATION: The Kaspersky scan engine for Antigen has been rolled back."

    We have tried all of the suggestions found on the internet, including:

    • Anything suggested in this thread http://social.technet.microsoft.com/Forums/en-US/Antigen/thread/4c97dfcb-f8ef-4d09-905e-f710b941aca8
    • Installing the latest rollup (RU4), so getenginefiles.exe is current (KB2508121)
    • Increasing / creating the EngineDownloadTimeout and GetFileHTTPTimeout registry keys (KB905991 and KB924705)
    • Emptying the kaspersky engine folder before an update
    • Removing orphaned update folders under Engines\metadata
    • Manually downloading localenginemapping.cab, EngineInfo.cab and UniversalManifest.cab (KB2284024)
    • Manually starting the ELI update task before an update
    • Creating a local folder structure with manifest.cab and kaspersky_fullpkg.cab to update from (KB920304)
    • Completely removing Antigen, folders and registry keys for a clean re-install

    The downloaded data on every attempt is >110MB, so it's definitely a full update.

    We even restored old versions of the engine. After restoring the kaspersky folder and registry entries from July 2nd (engine version 8.0.2.48), the engine loaded successfully, an update however still failed. The engine from August 26th (8.1.8.79) which had worked fine on that day now won't load either!

    Any suggestions?

    Philipp

    Wednesday, September 28, 2011 9:18 AM

Answers

  • In Forefront Protection 2010 for Exchange there is a folder called C:\ProgramData\Kaspersky SDK which contains some files. I don't know if this one exists for Antigen too, but cleaning this folder sometimes solves update issues with the Kaspersky engine.

    Sorry, I got the wrong folder in my previous post, the corresponding folder is of course C:\Documents and Settings\All Users\Application Data\Kaspersky SDK. It only contained a 2 KB file called "storage520.dat", but when I renamed the folder, the next update succeeded!

    The only thing now is, all entries in the "Scanner information" table are now shown as unknown. The registry still contains the values from the restored 8.1.8.79 engine. Can I simply delete the keys?

    Thanks a lot for your help, you have been brilliant!

    All the best

    Philipp


    Wednesday, September 28, 2011 10:51 AM

All replies

  • Hi Philipp,

    make sure that your local AV has an exception for the installation directory of Antigen.

    In Forefront Protection 2010 for Exchange there is a folder called C:\ProgramData\Kaspersky SDK which contains some files. I don't know if this one exists for Antigen too, but cleaning this folder sometimes solves update issues with the Kaspersky engine.

    Greetings

    Christian


    Christian Groebner MVP Forefront
    Wednesday, September 28, 2011 9:59 AM
  • Hi Christian,

    thanks for your reply.

    In fact, we are not using a virus scanner on our Exchange server (apart from Antigen), I hope that is not the reason for the engine failures ;-)

    Antigen uses a similar folder under C:\WINDOWS\Temp\SDK8. I have already cleaned / renamed that folder, but that did not have any effect.

    Any other ideas?

    Kind regards

    Philipp

    Wednesday, September 28, 2011 10:28 AM
  • Hi,

    do you use a caching proxy server? I could imagine that the "corrupted" update package is delivered out of the cache. If so exclude forefrontdl.microsoft.com or antigendl.microsoft.com from the cache.

    Greetings

    Christian


    Christian Groebner MVP Forefront
    Wednesday, September 28, 2011 10:34 AM
  • In Forefront Protection 2010 for Exchange there is a folder called C:\ProgramData\Kaspersky SDK which contains some files. I don't know if this one exists for Antigen too, but cleaning this folder sometimes solves update issues with the Kaspersky engine.

    Sorry, I got the wrong folder in my previous post, the corresponding folder is of course C:\Documents and Settings\All Users\Application Data\Kaspersky SDK. It only contained a 2 KB file called "storage520.dat", but when I renamed the folder, the next update succeeded!

    The only thing now is, all entries in the "Scanner information" table are now shown as unknown. The registry still contains the values from the restored 8.1.8.79 engine. Can I simply delete the keys?

    Thanks a lot for your help, you have been brilliant!

    All the best

    Philipp


    Wednesday, September 28, 2011 10:51 AM
  • Hi Philipp,

    are the values still unknown when you reopen the console? I wouldn't remove any keys, but you can try it when you do an export of the regkeys before.

    Greetings

    Christian


    Christian Groebner MVP Forefront
    Wednesday, September 28, 2011 10:56 AM
  • Removing the kaspersky key, cycling the antigen service, re-opening the console and pressing F5 a couple of times did the trick.

    Now my Kaspersky engine is fully updated again with the correct version showing in the Antigen console!

    Thanks again for your help!

    Kind regards

    Philipp

    Wednesday, September 28, 2011 11:09 AM