The FIP-FS Scan Process failed initialization. Error: 0x80010105 AND Faulting application name: scanningprocess.exe

Question

Hi,

Exchange 2016 on Server 2016.

The FIP-FS Service is crashing and mail isn't being sent or received.
mail only flows when the anti malware service is disabled within Exchange.

Errors which are show are:
1: The FIP-FS Scan Process failed initialization. Error: 0x80010105. Error Details: The server threw an exception.

2: Faulting application name: scanningprocess.exe, version: 15.1.2176.9, time stamp: 0x60276c79
Faulting module name: scanningprocess.exe, version: 15.1.2176.9, time stamp: 0x60276c79
Exception code: 0xc0000005
Fault offset: 0x000000000005c5fd
Faulting process id: 0x3cf4
Faulting application start time: 0x01d713bf77380dbc
Faulting application path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\scanningprocess.exe
Faulting module path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\scanningprocess.exe
Report Id: ea2fad9c-70c5-4e2a-9662-5906f6da0eb1
Faulting package full name:

3: The anti-malware agent encountered an error while scanning. MessageId: <ce6f9d3a-a94d-473e-a8d6-cd222d267627@journal.report.generator> Message sent: 5/03/2021 1:21:48 AM From: <> Size: 727629 Bytes Error: Microsoft.Filtering.ScanAbortedException: Exception of type 'Microsoft.Filtering.ScanAbortedException' was thrown.
at Microsoft.Filtering.InteropUtils.ThrowPostScanErrorAsFilteringException(WSM_ReturnCode code, String message)
at Microsoft.Filtering.FilteringService.EndScan(IAsyncResult ar)
at Microsoft.Exchange.Transport.Agent.Malware.MalwareAgent.OnScanCompleted(IAsyncResult ar)
Faulting package-relative application ID:

We tried to stop the service, update engine and signatures with the powershell command "& $env:ExchangeInstallPath\Scripts\Update-MalwareFilteringServer.ps1 -Identity <FQDN of server>" which also throws an error.

I saw post: https://social.msdn.microsoft.com/Forums/en-US/33020637-55a8-4c03-a239-e8aabff23b4d/the-fipfs-scan-process-failed-initialization?forum=exchangesvrsecuremessaging
But this didn't work.

Any help appreciated

Answer 1

set-malwarefilteringserver and disable-antimalwarescanning.ps1 didn't work for me. There were other errors in the event log and I had to grant network services full access to this key:

'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v15\WorkerTaskFramework\IdStore\ProbeDefinitionIDConflicts' is denied.

After about 10 minutes the submission queues cleared.

Answer 2

Ran into the same problem early this morning. Its great getting text messages about e-mail being down on new years. Happy New Year everyone!

I'm not a fan of bypassing the anti-malware features but we need e-mail working.

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn
Get-MalwareFilteringServer | Set-MalwareFilteringServer -BypassFiltering $true
$servers = $(Get-MalwareFilteringServer).Name
foreach($server in $servers){
    invoke-command -computername $server {
        Restart-Service MSExchangeTransport
        Restart-Service MSExchangeFrontEndTransport
    }
}

Answer 3

My original issue was from a failed CU update but the issue came back yesterday on multiple exchange servers out of the blue.
Same error message but different cause.
Disabling malware scanning seems to be the only fix for now.
Great happy new year message from Microsoft.
Why not break millions of exchange servers on the first of January

Answer 4

A fix has been issued but I can't find anything directly from Microsoft. For a short period during the night (UK Time) the issue had appeared on the Microsoft Admin app but it now does not even show up as an issue let alone with the fix so I found the resolution from this persons blog. https://jaapwesselius.com/2022/01/01/the-fip-fs-scan-process-failed-initialisation-mail-is-queued-on-exchange-servers/ under update 2.

Answer 5

I have run this script and all is now well