Microsoft Systems Management Server 2003 Inventory Tool for Microsoft Updates cannot run when a McAfee antivirus program is installed on the same computer

Article translations Article translations
Article ID: 922358 - View products that this article applies to.
Expand all | Collapse all

SYMPTOMS

Consider the following scenario. You use the Microsoft Systems Management Server (SMS) 2003 Inventory Tool for Microsoft Updates (ITMU) to scan for updates on a computer. The computer is also running a McAfee Antivirus program. In this scenario, ITMU may not be able to start the security update scanning tool (Scanwrapper.exe).

Additionally, you may receive an error message that resembles the following in the SmsWusHandler.log:
Scan process started with cmdline = /Catalog:C:\WINNT\system32\VPCache\NOV00027\wsusscan.cab /OutputXml:C:\WINNT\system32\VPCache\NOV00027\Results.xml
SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764)
WUS client version detected on the machine = 5.8.0.2469.
SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764)
Running the SMS WUS Handler in scan mode
SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) LocaleID=<1033> will be used to get localized properties.
SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) Searching for all the ServicePacks now
SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) Search filter - CategoryIDs contains '68C5B0A3-D1A6-4553-AE49-01D3A7827828'
SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) Using C:\WINNT\system32\VPCache\NOV00027\wsusscan.cab as the offline-catalog.
SmsWusHandler 9/28/2005 3:55:10 PM 1892 (0x0764) AddScanPackageService() failed. SmsWusHandler 9/28/2005 3:55:44 PM 1892 (0x0764)
ERROR: Search() failed with hRes=0xc8000408
SmsWusHandler 9/28/2005 3:55:44 PM 1892 (0x0764) 0xc8000408 is the result value for the operation. Returning 1032 as the exit code.
SmsWusHandler 9/28/2005 3:55:44 PM 1892 (0x0764)
You may also receive an error message that resembles the following in the SmsWusHandler.log on the client:
4/9/2007 4:36:25 PM ~======== SmsWusHandler Started ========
4/9/2007 4:36:25 PM Scan process started with cmdline = /Catalog:C:\WINNT\system32\VPCache\NUS001F1\wsusscn2.cab /OutputXml:C:\WINNT\system32\VPCache\NUS001F1\Results.xml
4/9/2007 4:36:25 PM WUS client version detected on the machine = 5.8.0.2694.
4/9/2007 4:36:25 PM Running the SMS WUS Handler in scan mode
4/9/2007 4:36:25 PM LocaleID=<1033> will be used to get localised properties.
4/9/2007 4:36:25 PM Searching for software updates now.
4/9/2007 4:36:25 PM Search filter - Type='Software'
4/9/2007 4:36:25 PM Using C:\WINNT\system32\VPCache\NUS001F1\wsusscn2.cab as the offline-catalog.
4/9/2007 4:36:25 PM Registering a new scan package service with the Windows Update Agent.
4/9/2007 4:36:32 PM Scan Package serviceID being used for this search is {a5228644-8401-4e16-98b5-78344cb2452f}
4/9/2007 4:36:52 PM ERROR: UpdateSearcher::Search() failed.
4/9/2007 4:36:52 PM An error occurred when searching with the existing scan package service. Removing the service...
4/9/2007 4:36:52 PM ERROR: Search() failed with hRes=0xc80001fe
4/9/2007 4:36:52 PM 0xc80001fe is the hresult value for the operation. Returning 510 as the exit code.
4/9/2007 4:36:52 PM ~ ======= SmsWusHandler Terminating =======

CAUSE

This problem occurs when the McAfee antivirus program is configured to scan the %Windir%\SoftwareDistribution folder on the computer on which the ITMU scan is run. In this case, when the McAfee antivirus program scans the .edb file, the antivirus program locks the file. Therefore, the ITMU cannot access the .edb file.

WORKAROUND

To work around this problem, make sure that the McAfee antivirus program does not scan the files in the %windir%\SoftwareDistribution folder on any computer on which the Windows Update Agent is installed.

For computers that are running Microsoft Windows Server 2003, Microsoft Windows 2000, or Microsoft Windows XP, do not scan the following files and folders. These files are not at risk of infection. If you scan these files, serious performance problems may occur because of file locking. Where a specific set of files is identified by name, exclude only those files instead of the whole folder. Sometimes, the whole folder must be excluded. Do not exclude any one of these items based on the file name extension. For example, do not exclude all files that have a .dit extension. Microsoft has no control over other files that may use the same extensions as the following files:
  • Microsoft Windows Update or Automatic Update related files
  • The Windows Update or Automatic Update database file. This file is located in the following folder:
    %windir%\SoftwareDistribution\Datastore
    Exclude the Datastore.edb file.
  • The transaction log files. These files are located in the following folder:
    %windir%\SoftwareDistribution\Datastore\Logs
    Exclude the following files:
    • Edb*.log

      Note The wildcard character indicates that there may be several files.
    • Res1.log
    • Res2.log
    • Edb.chk
    • Tmp.edb
For more information about virus scanning recommendations for computers that are running Windows Server 2003, Windows 2000, or Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:
822158 Virus scanning recommendations for computers that are running Windows Server 2003, Windows 2000, or Windows XP

For more information about McAfee antivirus, refer to the McAfee antivirus documentation.
For information about your hardware manufacturer, visit the following Web site:
http://support.microsoft.com/gp/vendors/en-us

Properties

Article ID: 922358 - Last Review: May 17, 2007 - Revision: 3.1
APPLIES TO
  • Microsoft Systems Management Server 2003
Keywords: 
kbtshoot kbprb KB922358

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com