question

SebastianWalz-3344 avatar image
3 Votes"
SebastianWalz-3344 asked ilianko-6627 commented

The FIP-FS Scan Process failed initialization. Error: 0x80010105 AND Faulting application name: scanningprocess.exe

Hi,

Exchange 2016 on Server 2016.

The FIP-FS Service is crashing and mail isn't being sent or received.
mail only flows when the anti malware service is disabled within Exchange.

Errors which are show are:
1: The FIP-FS Scan Process failed initialization. Error: 0x80010105. Error Details: The server threw an exception.

2: Faulting application name: scanningprocess.exe, version: 15.1.2176.9, time stamp: 0x60276c79
Faulting module name: scanningprocess.exe, version: 15.1.2176.9, time stamp: 0x60276c79
Exception code: 0xc0000005
Fault offset: 0x000000000005c5fd
Faulting process id: 0x3cf4
Faulting application start time: 0x01d713bf77380dbc
Faulting application path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\scanningprocess.exe
Faulting module path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\scanningprocess.exe
Report Id: ea2fad9c-70c5-4e2a-9662-5906f6da0eb1
Faulting package full name:

3: The anti-malware agent encountered an error while scanning. MessageId: <ce6f9d3a-a94d-473e-a8d6-cd222d267627@journal.report.generator> Message sent: 5/03/2021 1:21:48 AM From: <> Size: 727629 Bytes Error: Microsoft.Filtering.ScanAbortedException: Exception of type 'Microsoft.Filtering.ScanAbortedException' was thrown.
at Microsoft.Filtering.InteropUtils.ThrowPostScanErrorAsFilteringException(WSM_ReturnCode code, String message)
at Microsoft.Filtering.FilteringService.EndScan(IAsyncResult ar)
at Microsoft.Exchange.Transport.Agent.Malware.MalwareAgent.OnScanCompleted(IAsyncResult ar)
Faulting package-relative application ID:


We tried to stop the service, update engine and signatures with the powershell command "& $env:ExchangeInstallPath\Scripts\Update-MalwareFilteringServer.ps1 -Identity <FQDN of server>" which also throws an error.

I saw post: https://social.msdn.microsoft.com/Forums/en-US/33020637-55a8-4c03-a239-e8aabff23b4d/the-fipfs-scan-process-failed-initialization?forum=exchangesvrsecuremessaging
But this didn't work.

Any help appreciated

office-exchange-server-mailflow
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi, @SebastianWalz-3344

Do you have some third-party Anti-Virus Software installed (now or before) on your Exchange server?

And what is the error when you failed to update the Anti-malware Engine?
Did you see some Event ID 6027 generated in the application log?
If so, please refer to this article to troubleshot the problem: Exchange 2013 Malware Engine Updates Troubleshooting


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 Votes 0 ·

Hi, @SebastianWalz-3344
I am writing here to confirm with you how thing going now?
Did the issue get resolved?

0 Votes 0 ·
ilianko-6627 avatar image
5 Votes"
ilianko-6627 answered ilianko-6627 commented

At 3:00 am The exchange server was stuck with this error:

The FIP-FS "Microsoft" Scan Engine failed to load. PID: 39268, Error Code: 0x80004005. Error Description: Can't convert "2201010003" to long. / Event ID 5300

I have disabled filtering:

Set-MalwareFilteringServer exch-19 -BypassFiltering $true

and email is going agian ... and I am looking for more info how to recover malware scanning service

FYI

· 6
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Exact the same error here,

The FIP-FS "Microsoft" Scan Engine failed to load. PID: 43256, Error Code: 0x80004005. Error Description: Can't convert "2201010003" to long.

Temporary disabled Antimalware scanning :
& $env:ExchangeInstallPath\Scripts\Disable-AntimalwareScanning.ps1

0 Votes 0 ·

Same story here,
Set-MalwareFilteringServer [server] -BypassFiltering $true
helped.

1 Vote 1 ·

Same error,same solution. Will w8 for MS fix it

0 Votes 0 ·

I had to restart the Transport service.

0 Votes 0 ·

All of my customers with on Prem Exchange 2016 servers had this issue, thanks for sharing your work around!

0 Votes 0 ·

Change the execution policy for PowerShell: Set-ExecutionPolicy -ExecutionPolicy RemoteSigned.
Download the script: https://aka.ms/ResetScanEngineVersion
Use elevated Exchange Management Shell, run on every server.

[PS] C:\Users\admin\Downloads>.\Reset-ScanEngineVersion.ps1
File C:\Users\admin\Downloads\Reset-ScanEngineVersion.ps1 is published by CN=Microsoft Corporation, O=Microsoft
Corporation, L=Redmond, S=Washington, C=US and is not trusted on your system. Only run scripts from trusted publishers.
[V] Never run [D] Do not run [R] Run once [A] Always run [?] Help (default is "D"): a
EXCH-19 UpdateVersion: 2201010009
EXCH-19 Stopping MSExchangeTransport, FMS, and updateservice...

Stop-Service : Time out has expired and the operation has not been completed.
At C:\Users\admin\Downloads\Reset-ScanEngineVersion.ps1:48 char:13
+ Stop-Service FMS -Force

System.ServiceProcess.TimeoutException,Microsoft.PowerShell.Commands.StopServiceCommand
WARNING: EXCH-19 Could not end process updateservice.exe. Please end this process and rerun the script.


[PS] C:\Users\admin\Downloads>.\Reset-ScanEngineVersion.ps1
EXCH-19 UpdateVersion: 2201010009
EXCH-19 Stopping MSExchangeTransport, FMS, and updateservice...
WARNING:… stop

WARNING:… start
WAIT 10 MINUTES
Connecting to exch-19
Dispatched remote command. Start-EngineUpdate -UpdatePath http://amupdatedl.microsoft.com/server/amupdate

[1]: https://techcommunity.microsoft.com/t5/exchange-team-blog/email-stuck-in-exchange-on-premises-transport-queues/ba-p/3049447






0 Votes 0 ·
WillJudy-1808 avatar image
0 Votes"
WillJudy-1808 answered Jay-3757 commented

This has just happened to me as well. Exchange 2016 and 2019. Is this a Zero Day hack or something trying to disable the malware scanning?

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Not a zero day - more likely that a bad update was pushed out causing the required service to crash. I have had to use the work around provided on several customers with on prem exchange 2016 servers. All have the same error at approximately the same time after downloading an update.

0 Votes 0 ·
RafaelRung-5398 avatar image
3 Votes"
RafaelRung-5398 answered RafaelRung-5398 published

oh great, thank you very much, set-malwarefilterserver command fixed it for me also. but i had to restart "Microsoft Exchange Transport" Service after that...

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

MarcoGiuricin-1033 avatar image
1 Vote"
MarcoGiuricin-1033 answered

Same here, same problem and same resolution

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LucianoCoppola-6314 avatar image
0 Votes"
LucianoCoppola-6314 answered pravinbedekar-9083 commented

Same here but what I have noticed is that the FIP-FS Scan process Initialization error is still present and emails sit in the queue for up to 5 minutes before being released. Anybody else have this?

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I had the same problem but I restarted transposrt service and all email was sent
Restart-Service MSExchangeTransport
Restart-Service MSExchangeFrontEndTransport

1 Vote 1 ·

If a new email comes in is it delivered almost immediately to the mailbox or is there a delay. Mine sit in the queue for 3 to 5 minutes before being delivered, same for outgoing emails. So email flow is working again but with delays.

0 Votes 0 ·

Yes, I did the same, but still mails are getting delayed by 3-5 min

1 Vote 1 ·
LewisHolyfield-6725 avatar image
1 Vote"
LewisHolyfield-6725 answered

I just experienced the same issue as others described, 'Microsoft Filtering Management Service' was continuously crashing until we executed the set-MalwareFilteringServer <ExchangeServer> -BypassFiltering:$true.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FletcherBarnett-6903 avatar image
2 Votes"
FletcherBarnett-6903 answered

Same problem same solution on a EX2016 box. Starting the year off right, eh Microsoft?!

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HolmesNetworks-5741 avatar image
2 Votes"
HolmesNetworks-5741 answered RonLime-7477 commented

Same for all my Exchange 2016 and 2019 clients. Bypassing is enough.

  1. Set-MalwareFilteringServer <ServerIdentity> -BypassFiltering $true

  2. Restart the Microsoft Exchange Transport service.

Reference: https://docs.microsoft.com/en-us/exchange/disable-or-bypass-anti-malware-scanning-exchange-2013-help

(I know it says 2013, it still works)



· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Did this on my EX2016 on-prem and it worked for me also.

1 Vote 1 ·
JrmieSENECHAL-8047 avatar image
2 Votes"
JrmieSENECHAL-8047 answered

Idem for me.. same problem and of course same solution : Bypassfiltering $true and restart Exchange Transport Service.

Wait for MS update to Rollback... don't like this kind of situation...

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JoshuaThompson-0351 avatar image
0 Votes"
JoshuaThompson-0351 answered JoshuaThompson-0351 edited

Same problem here on Exchange 2016 . Just stopped working around 6:09PM (PST) last night (December 31, 2021).
In my situation mail flow is not being impacted inbound or outbound. We are in a hybrid setup.

I guess we just wait for the update.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.