You are currently offline, waiting for your internet to reconnect

Virtualized applications fail to launch and generate 00-000000C3 errors in sftlog.txt

Symptoms
On Windows Server 2008 R2 SP1 Remote Desktop Services (RDS) servers running the App-V RDS client version 4.6.1.30151 and Forefront Endpoint Proection (FEP) Malware version 3.X, App-V applications stop working after 2-3 days and a reboot is required to restore App-V functionality. The following error may also be logged in the App-V client's sftlog.txt file:

[12/06/2012 11:18:21:968 INTF ERR] {tid=1194}
The Application Virtualization Client has encountered a serious error.  All applications
deployed through the Application Virtualization Client have been terminated.  Please stop the
Client, copy the sftfs.etl file in the installation directory to a safe
place, and contact Technical Support.

[12/06/2012 11:18:22:077 TRAY ERR] {tid=5368:usr=JohnB}
Snagit 10 10.0.0.788

An unexpected error occurred. Report the following error code to your System Administrator.
Error code: 46175B3-00000000-000000C3

NOTE Non-App-V applications are unaffected.

Cause
This can occur if the Forefront Endpoint Protection (FEP) Malware program MsMPEng.exe is scanning the App-V client's virtual drive. By default this is the Q: drive but it could be any drive configured during App-V client installation.
Resolution
To resolve this issue, update the FEP agent to Version 4.1.522.0 or higher and verify that the App-V virtual drive (Default is Q:) is defined in the FEP exclusion policy. Use the steps outlined in the More Information section to verify with Process Monitor that MsMpEng.exe is no longer scanning the Q: drive. For example, if FEP is monitoring the Q: drive you will see entries similar to the following:

7:34:08.3177871 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 32,768, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
7:34:08.3179787 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 65,536, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
7:34:08.3185970 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 98,304, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal


More information
How to run Process Monitor (ProcMon) inside the App-V virtual environment: http://blogs.technet.com/b/appv/archive/2012/04/24/how-to-run-process-monitor-procmon-inside-the-app-v-virtual-environment.aspx.

2576031 Recommended antivirus or antimalware exclusions when troubleshooting Application Virtualization (App-V) client issues
http://support.microsoft.com/kb/2576031/EN-US)

Forefront Endpoint Protection (FEP) 4.1.522.0 39-000000002 00-000000C3 39-0000010B App-V Q drive SFT_MNT RDS Terminal Server Citrix
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.
Properties

Article ID: 2792121 - Last Review: 12/17/2012 19:21:00 - Revision: 7.0

Microsoft Application Virtualization 4.6 for Terminal Services Service Pack 1, Microsoft Application Virtualization 5.0 for Terminal Services, Microsoft Forefront Endpoint Protection 2010

  • KB2792121
Feedback
oft.com/c.gif?DI=4050&did=1&t=">