A restart of the service Symantec Mail Security for Microsoft Exchange clears the issue.
The following events show up in the Windows Application Event log:
Event ID 110 - The process SavFmsesp.exe failed to start (0xC009008A).
Event ID 168 - The process SAVFMSESp.exe was restarted.
Event ID 68 - Unable to initialize scan engine. The virus definitions may be missing or corrupt. Perform a liveupdate to retrieve the latest virus definitions.
Event ID 167 - The process SAVFMSESp.exe terminated unexpectedly.
When new virus definitions are available SMSMSE copies them from the Hawking directory to the CSAPI directory. If this copy process takes longer than 60 seconds then another SMSMSE process starts the copy process. When there is more than one copy process running at the same time the virus definitions become "corrupted" in the CSAPI directory. This results in the SMSMSE processes not being able to restart or reinitialize themselves.
If this issue persists increase the copy timeout using the following steps:
1. Run regedit. 2. Create the following DWORD registry key:
64 bit Operating System: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SMSMSE\<version>\Server\DefsUpdateTimeInSecs 32 bit Operating System: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SMSMSE\<version>\Server\DefsUpdateTimeInSecs
NOTE: Replace <version> with the version of SMSMSE installed. For example on a 32-bit system with 6.5 installed the key is: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SMSMSE\6.5\Server\DefsUpdateTimeInSecs.
3. Set the value of the key to be the timeout in seconds. For example to set a ten (10) minute timeout set the value to 600. 4. Close Regedit. 5. Restart the following SMSMSE service:
Symantec Mail Security for Microsoft Exchange
Configure LiveUpdate to update virus definitions at a time that the server has free resources. Typically scheduling during early morning periods will resolve this issue.
Use the following steps to configure the virus definition update time:
1. Open the SMSMSE Administration Console. 2. Click on the Admin tab. Then click on Views|LiveUpdate/Rapid Release Schedule. 3. Click the Run at a specific time radio option. Then set up the schedule. 4. When finished click the Deploy Changes button.