The FIP-FS Scan Process failed initialization. Error: 0x80010105 AND Faulting application name: scanningprocess.exe

Question

Hi,

Exchange 2016 on Server 2016.

The FIP-FS Service is crashing and mail isn't being sent or received.
mail only flows when the anti malware service is disabled within Exchange.

Errors which are show are:
1: The FIP-FS Scan Process failed initialization. Error: 0x80010105. Error Details: The server threw an exception.

2: Faulting application name: scanningprocess.exe, version: 15.1.2176.9, time stamp: 0x60276c79
Faulting module name: scanningprocess.exe, version: 15.1.2176.9, time stamp: 0x60276c79
Exception code: 0xc0000005
Fault offset: 0x000000000005c5fd
Faulting process id: 0x3cf4
Faulting application start time: 0x01d713bf77380dbc
Faulting application path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\scanningprocess.exe
Faulting module path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\scanningprocess.exe
Report Id: ea2fad9c-70c5-4e2a-9662-5906f6da0eb1
Faulting package full name:

3: The anti-malware agent encountered an error while scanning. MessageId: <ce6f9d3a-a94d-473e-a8d6-cd222d267627@journal.report.generator> Message sent: 5/03/2021 1:21:48 AM From: <> Size: 727629 Bytes Error: Microsoft.Filtering.ScanAbortedException: Exception of type 'Microsoft.Filtering.ScanAbortedException' was thrown.
at Microsoft.Filtering.InteropUtils.ThrowPostScanErrorAsFilteringException(WSM_ReturnCode code, String message)
at Microsoft.Filtering.FilteringService.EndScan(IAsyncResult ar)
at Microsoft.Exchange.Transport.Agent.Malware.MalwareAgent.OnScanCompleted(IAsyncResult ar)
Faulting package-relative application ID:

We tried to stop the service, update engine and signatures with the powershell command "& $env:ExchangeInstallPath\Scripts\Update-MalwareFilteringServer.ps1 -Identity <FQDN of server>" which also throws an error.

I saw post: https://social.msdn.microsoft.com/Forums/en-US/33020637-55a8-4c03-a239-e8aabff23b4d/the-fipfs-scan-process-failed-initialization?forum=exchangesvrsecuremessaging
But this didn't work.

Any help appreciated

Answer 1

At 3:00 am The exchange server was stuck with this error:

The FIP-FS "Microsoft" Scan Engine failed to load. PID: 39268, Error Code: 0x80004005. Error Description: Can't convert "2201010003" to long. / Event ID 5300

I have disabled filtering:

Set-MalwareFilteringServer exch-19 -BypassFiltering $true

and email is going agian ... and I am looking for more info how to recover malware scanning service

FYI

Answer 2

oh great, thank you very much, set-malwarefilterserver command fixed it for me also. but i had to restart "Microsoft Exchange Transport" Service after that...

Answer 3

Same problem same solution on a EX2016 box. Starting the year off right, eh Microsoft?!

Answer 4

Same for all my Exchange 2016 and 2019 clients. Bypassing is enough.

1. Set-MalwareFilteringServer <ServerIdentity> -BypassFiltering $true
2. Restart the Microsoft Exchange Transport service.

Reference: https://learn.microsoft.com/en-us/exchange/disable-or-bypass-anti-malware-scanning-exchange-2013-help

(I know it says 2013, it still works)

Answer 5

Idem for me.. same problem and of course same solution : Bypassfiltering $true and restart Exchange Transport Service.

Wait for MS update to Rollback... don't like this kind of situation...