WelcomeProducts & ServicesSecurity ResponseSupportSolutions & IndustriesLicensingTrainingStore
Enterprise
Symantec.com > Enterprise > Support > Knowledge Base


IIS buffer overrun problems with libspamhunter.dll in Symantec Mail Security for Microsoft Exchange

Symptoms:
You have Symantec Mail Security 4.x or 5.x for Microsoft Exchange. Your IIS service fails at intervals of 5 to 25 minutes. You see entries in the event log that are similar to the following:

"The description for Event ID ( 1 ) in Source ( IISCTLS ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: NT AUTHORITY\SYSTEM."

You may see other messages in the event log as well.


Solution:
Symantec Mail Security for Microsoft Exchange 5.0.6 resolves this problem. If you cannot immediately upgrade to 5.0.6 or later, workaround this behavior by editing the bmiconfig.xml file.

To obtain the latest upgrade, follow the link in the References section of this page.

Note: Symantec strongly recommends that you export your settings and remove the old version of the program before you install the new version.

To modify the bmiconfig.xml file

  1. Open the services menu by going to Start -> Run and typing services.msc
  2. Stop the Symantec Mail Security for Microsoft Exchange service, and the Symantec Mail Security Spam Statistics service, if they are started.
  3. Open <system drive>:\Program Files\Symantec\SMSMSE\5.0\Server\SpamPrevention\bmiconfig.xml in a text editor such as notepad.
  4. Before making changes, save the file as bmiconfig.old
  5. Delete the following strings: 
    <ruleType>header_regex</ruleType>
    <ruleType>body_regex</ruleType>
    <ruleType>lang_header_regex</ruleType>
    <ruleType>lang_body_regex</ruleType>
    <ruleType>bodysig</ruleType>
  6. Save the edited file as bmiconfig.xml
  7. Restart the Symantec Mail Security for Microsoft Exchange service; it is not necessary to restart the Spam Statistics service.

This workaround should temporarily resolve the issue until you can upgrade. As a side effect, you may notice some loss of effectivess for Premium Antispam.



References:
For information to get an upgrade for your product, read the following Symantec Knowledge Base article:
How to obtain an update or an upgrade for your Symantec corporate product



Document ID: 2006120116344254
Last Modified: 04/07/2008
Date Created: 12/01/2006
Operating System(s): Windows 2000 Server SP4, Windows 2000 Advanced Server SP4, Windows Server 2003 Standard SP1, Windows Server 2003 Advanced SP1, Windows 2000 Server/Advanced Server/Data Center SP4, Windows Server 2003 Standard/Enterprise/Data Center (no SP required), Exchange 2000 Server SP3/Enterprise Server, Exchange Server 2003/Enterprise Server
Product(s): Symantec Mail Security 4.6 for Microsoft Exchange, Symantec Mail Security 5.x for Microsoft Exchange
Release(s): MSME 5.0 [All Releases], SMS 4.6 [All Releases]


Site Index · Legal Notices · Privacy Policy · · Contact Us · Global Sites · License Agreements
©1995 - 2010 Symantec Corporation