The Exchange server is beeping, and / or you are getting the following events or a combination thereof in the Windows Application Event log:
Event ID 110 - The process SAVFMSESp.exe failed to start (0xC009008A). Event ID 168 - The process SAVFMSESp.exe was restarted. Event ID 68 - Unable to initialize scan engine. The virus definitions may be missing or corrupt. Perform a LiveUpdate to retrieve the latest virus definitions. Event ID 167 - The process SAVFMSESp.exe terminated unexpectedly.
Users are unable to retrieve messages with attachments from Exchange
The file Usage.dat does not contain entries for SAVFMSE_SP processes.
Default path for Usage.dat: Windows 2003 x86 - C:\Program Files\Common Files\Symantec Shared\VirusDefs Windows 2003 x64 - C:\Program Files(x86)\Common Files\Symantec Shared\SymcData\virusdefs32 Windows 2008 - C:\ProgramData\Symantec\Definitions\SymcData\virusdefs32
This is most commonly caused by corruption in the Virus Definitions.
Double-click the EXE file you downloaded and run the Intelligent Updater.
Restart the SMSMSE service.
If this does not fix the problem, proceed with the next section.
Uninstall of Symantec Mail Security for Exchange/LiveUpdate AntiVirus Definition Directories
NOTE: If you are running Symantec AntiVirus version of less than 10.1.x, this procedure may require that you reinstall Symantec AntiVirus as well. Please contact your Symantec AntiVirus technical support for more information. If you are running Symantec Endpoint Protection, or backup Exec or any other software which is using that liveupdate. Please make sure that you contact Symantec Technical Support before removing Symantec Liveupdate.
1. Export the settings via the File menu. 2. Open Add and Remove Programs in Windows and remove Symantec Mail Security for Microsoft Exchange.
The SMSMSE development team is investigating potential root causes for these definition corruption issues, and what we can do to resolve these problems in the long term. This data will assist us in that process.