none
SharePoint 2010 Crawler tripped antivirus

    Question

  • This morning I noticed the crawler in our environment had a couple errors over the weekend. There were 3 instances with similar names of the file.

    The antivirus message excerpt: "The following error occurred: Error code 0x80508023. The program could not find the malware and other potentially unwanted software on this computer. "

    C:\Users\{CrawlerAccount}\AppData\Local\Temp\gthrsvc_OSearch14\{renamed_file}.doc

    It seems a bit odd because in System Center End Point Protection the directory: C:\Users\{CrawlerAccount}\AppData\Local\Temp\ is excluded. 

    I suspect the error is a false positive, but curious why the antivirus caught the file since we have the directory above gthrsvc_OSearch14 excluded.   (My thought is the crawler deleted the file before the Antivirus was able to scan the file, so it became unhappy.)  Strange though I've been looking through the ULS logs for the path to the {renamed_file}.doc, and couldn't find it. 

    Any thoughts on a good approach to finding the file to confirm, and why the Antivirus set an alarm?


    Joe--

    Monday, May 20, 2019 6:31 PM

Answers

  • Hi Joe,

    Yes, the exclusion of the subfolders applies to the search entry as well.

    Best regards,

    Sara Fan


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Monday, May 27, 2019 8:21 AM
    Moderator

All replies

  • I have seen this almost all of our environments, I dont think there is way to see the original file name. please refer this forum for little more insight.

    https://answers.microsoft.com/en-us/protect/forum/all/error-code-0x80508023-the-program-could-not-find/42070c38-fe26-4ea6-b485-0a599dc5685f

    Monday, May 20, 2019 7:03 PM
  • Thanks for the reply.  

    After looking at the article it indicates there may be an issue with the doc files?  If so is there a way to find the particular file?

    For the error that the antivirus client is showing it does seem to be a false positive on the error. 

    Thanks in advance.

    Joe--


    Joe--

    Monday, May 20, 2019 9:47 PM
  • Hi rainmakers,

    To troubleshoot the issue, you could reset index and run a full crawl in search service application.

    More reference:

    How to Remove “Error code 0x80508023. The program could not find the malware and other potentially unwanted software on this computer.” Virus Thoroughly.

    http://deletepcinfection.com/how-to-remove-error-code-0x80508023-the-program-could-not-find-the-malware-and-other-potentially-unwanted-software-on-this-computer-virus-thoroughly

    Best regards,

    Sara Fan


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Tuesday, May 21, 2019 7:02 AM
    Moderator
  • Hi rainmakers,

    How is everything going?

    Is there anything update about this issue?

    If the reply is helpful to you, you could mark the helpful reply as answer. Thanks for your understanding.

    Best regards,

    Sara Fan

    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Thursday, May 23, 2019 2:05 AM
    Moderator
  • I did review https://support.office.com/en-us/article/certain-folders-may-have-to-be-excluded-from-antivirus-scanning-when-you-use-file-level-antivirus-software-in-sharepoint-01cbc532-a24e-4bba-8d67-0b1ed733a3d9

    In it there is an excerpt:

    "exclude the following folders and subfolders"

    We do have the " Drive:\Users\account that the search service is running as\AppData\Local\Temp" but in this context does the exclusion of the subfolders apply to the search entry as well?

    If so, then this would mean our AV client is not excluding sub-directories in our config. 


    Joe--

    Friday, May 24, 2019 1:20 PM
  • Hi Joe,

    Yes, the exclusion of the subfolders applies to the search entry as well.

    Best regards,

    Sara Fan


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Monday, May 27, 2019 8:21 AM
    Moderator
  • Hi Joe,

    If the reply is helpful to you, you could mark the reply as answer. Thanks for your understanding.

    Best regards,

    Sara Fan

    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Thursday, May 30, 2019 2:47 AM
    Moderator
  • Hi Joe,

    I am checking to see how things are going there on this issue. Please let us know if you would like further assistance.

    If the issue was resolved, you can mark the helpful post as answer to help other community members find the helpful information quickly. 

    Best regards,

    Sara Fan

    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Monday, June 3, 2019 2:39 AM
    Moderator