Virtualized applications fail to launch and generate 00-000000C3 errors in sftlog.txt

Article ID: 2792121 - View products that this article applies to.
Expand all | Collapse all

Symptoms

On Windows Server 2008 R2 SP1 Remote Desktop Services (RDS) servers running the App-V RDS client version 4.6.1.30151 and Forefront Endpoint Proection (FEP) Malware version 3.X, App-V applications stop working after 2-3 days and a reboot is required to restore App-V functionality. The following error may also be logged in the App-V client's sftlog.txt file:

[12/06/2012 11:18:21:968 INTF ERR] {tid=1194}
The Application Virtualization Client has encountered a serious error.  All applications
deployed through the Application Virtualization Client have been terminated.  Please stop the
Client, copy the sftfs.etl file in the installation directory to a safe
place, and contact Technical Support.

[12/06/2012 11:18:22:077 TRAY ERR] {tid=5368:usr=JohnB}
Snagit 10 10.0.0.788

An unexpected error occurred. Report the following error code to your System Administrator.
Error code: 46175B3-00000000-000000C3

NOTE Non-App-V applications are unaffected.

Cause

This can occur if the Forefront Endpoint Protection (FEP) Malware program MsMPEng.exe is scanning the App-V client's virtual drive. By default this is the Q: drive but it could be any drive configured during App-V client installation.

Resolution

To resolve this issue, update the FEP agent to Version 4.1.522.0 or higher and verify that the App-V virtual drive (Default is Q:) is defined in the FEP exclusion policy. Use the steps outlined in the More Information section to verify with Process Monitor that MsMpEng.exe is no longer scanning the Q: drive. For example, if FEP is monitoring the Q: drive you will see entries similar to the following:

7:34:08.3177871 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 32,768, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
7:34:08.3179787 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 65,536, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
7:34:08.3185970 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 98,304, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal


More information

How to run Process Monitor (ProcMon) inside the App-V virtual environment: http://blogs.technet.com/b/appv/archive/2012/04/24/how-to-run-process-monitor-procmon-inside-the-app-v-virtual-environment.aspx.

2576031 Recommended antivirus or antimalware exclusions when troubleshooting Application Virtualization (App-V) client issues
http://support.microsoft.com/kb/2576031/EN-US)

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Properties

Article ID: 2792121 - Last Review: December 17, 2012 - Revision: 7.0
Applies to
  • Microsoft Application Virtualization 4.6 for Terminal Services Service Pack 1
  • Microsoft Application Virtualization 5.0 for Terminal Services
  • Microsoft Forefront Endpoint Protection 2010
Keywords: 
KB2792121

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com