With SMSMSE version 6.5.4 and earlier the following events may appear in the Windows Application Event log:
Source: MSExchangeTransport Event ID: 348 Type: Error Description: A message could not be virus scanned - this operation will be retried later. Internet Message ID <message Id>Error Code 0x0.
Event Type: Error Event ID: 348 Event Source: Symantec Mail Security for Microsoft Exchange Event Category: Unscannable Description: SMTP scanning failed on the message with subject: <subject> This message has been set as bad mail on the SMTP server.
With SMSMSE 6.5.5 and later the following events may appear in the Windows Application Event log:
Event Type: Warning Event ID: 408 Event Source: Symantec Mail Security for Microsoft Exchange Event Category: Unscannable Description: SMTP scanning failed on the message with subject: <subject> This message will be rescanned upon reaching the mailbox only if you have configured rescanning on Mail Security for the mailbox role.
Transport Virus scanning is enabled.
1. Open regedit. 2. If the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\TransportAVAPI has a value of Enabled then this condition is met.
This problem has multiple causes. The following sections are the common causes and fixes. Work from top of this list to bottom, until error message is fixed.
Transport AVAPI prerequisites are not met on the server
If the either of the following conditions are not met, Event ID 348/408 is logged and email builds up in the Pending Submission queue.
* The Microsoft Exchange Information Store service is started. * The Mailbox Store or a Public Folder Store is mounted.
If a time out occurs, expect the debug to contain a line:
0xc0090085 in file ctrlintf.cpp
If this line exists, then consider increasing the SAVMSECRTL time out or increase the number of input threads.
WARNING: In the next steps you will edit the Windows registry. We strongly recommend that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the registry keys that are specified. See How to back up the Windows registry for instructions.
In the right pane, double-click the following value:
In the Value data box, type the following for the DWORD:
<number of threads >
where <number of threads>
is a number that you increase by an increment of 2. After each change, restart the Symantec Mail Security service. Continue to increment the number of threads until Event ID 348 no longer appears.
Test for an issue with the Transport AVAPI using the following steps:
Go to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SMSMSE\6.5\Server
Create a new DWORD called UseSMTPTransportSinkForTransportVirusScanning
Set the key to 1
Restart the SMSMSE service
Reset IIS: Go to Start > Run, type: iisreset
If the message was able to be received at that point, it is possible to stop scans that utilize the Transport Avapi.
You can either:
Turn off all content filtering rules.
Change content filtering rules from "Apply rule to: Incoming Messages" to "Apply rule to: Internal Messages (store)"
However, the best solution would be to repair the Transport Avapi. For more information on this, please contact Microsoft Technical support.
This error message is generated by Transport AVAPI which is specific to the Virus Scanning Application Programming Interface (VSAPI) 2.5. Therefore, this error message will only be observed on Exchange 2003.
Imported Document ID: TECH82732
Subscribing will provide email updates when this Article is updated. Login is required.