Virtualized applications fail to launch and generate 00-000000C3 errors in sftlog.txt

Applies to: Microsoft Application Virtualization 4.6 for Terminal Services Service Pack 1Microsoft Application Virtualization 5.0 for Remote Desktop ServicesForefront Endpoint Protection 2010

Symptoms


On Windows Server 2008 R2 SP1 Remote Desktop Services (RDS) servers running the App-V RDS client version 4.6.1.30151 and Forefront Endpoint Proection (FEP) Malware version 3.X, App-V applications stop working after 2-3 days and a reboot is required to restore App-V functionality. The following error may also be logged in the App-V client's sftlog.txt file:

[12/06/2012 11:18:21:968 INTF ERR] {tid=1194}
The Application Virtualization Client has encountered a serious error.  All applications
deployed through the Application Virtualization Client have been terminated.  Please stop the
Client, copy the sftfs.etl file in the installation directory to a safe
place, and contact Technical Support.

[12/06/2012 11:18:22:077 TRAY ERR] {tid=5368:usr=JohnB}
Snagit 10 10.0.0.788

An unexpected error occurred. Report the following error code to your System Administrator.
Error code: 46175B3-00000000-000000C3

NOTE Non-App-V applications are unaffected.

Cause


This can occur if the Forefront Endpoint Protection (FEP) Malware program MsMPEng.exe is scanning the App-V client's virtual drive. By default this is the Q: drive but it could be any drive configured during App-V client installation.

Resolution


To resolve this issue, update the FEP agent to Version 4.1.522.0 or higher and verify that the App-V virtual drive (Default is Q:) is defined in the FEP exclusion policy. Use the steps outlined in the More Information section to verify with Process Monitor that MsMpEng.exe is no longer scanning the Q: drive. For example, if FEP is monitoring the Q: drive you will see entries similar to the following:

7:34:08.3177871 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 32,768, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
7:34:08.3179787 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 65,536, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
7:34:08.3185970 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 98,304, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal


More Information


How to run Process Monitor (ProcMon) inside the App-V virtual environment: http://blogs.technet.com/b/appv/archive/2012/04/24/how-to-run-process-monitor-procmon-inside-the-app-v-virtual-environment.aspx.

2576031 Recommended antivirus or antimalware exclusions when troubleshooting Application Virtualization (App-V) client issues
http://support.microsoft.com/kb/2576031/EN-US)