SharePoint sites were not accessible. Getting Error “Exception from HRESULT: 0x80041054”

Issue:

======

SharePoint sites were not accessible. Getting Error “Exception from HRESULT: 0x80041054”

Error Information in Logs:

=================

"The SharePoint Service is running but the Forefront Security Endpoint VSAPI Library is not registered" on SharePoint server.

Root Cause:

==========

Forefront VSAPI DLL was not loaded properly within the w3wp.exe  because of incorrect or missing the CLSID due to which the DLL was not accessible, the entry within the SharePoint registry was not correctly configured and throwing above error and  antivirus scan was getting timed out and becomes unavailable on server, the antivirus scanner sets the VirusStatus code.  This makes SharePoint believe the Antivirus got issues and starts throwing error.

Solution:

=======

1.       Login to SharePoint server

2.       Stop running service “Microsoft Forefront Server Protection Controller”

3.       Stop running service “Microsoft Forefront Server Protection Controller for SharePoint”

4.       Go to your installation directory of Forefront Protection 2010 for SharePoint

5.       Run from command prompt: “fsccontroller.exe /disable”

6.       Run from command prompt: “fsccontroller.exe /enable”

7.       Restart SharePoint Services:

1.       SharePoint 2010 Administration

2.       SharePoint 2010 Timer

8.       Start service “Microsoft Forefront Server Protection Controller for SharePoint”

9.       Start service “Microsoft Forefront Server Protection Controller”

Check logs for Additional information:

=====================================

ULS Error Logs:

----------------
00:20.7      w3wp.exe (0x3660)                                        0x2E18       SharePoint Foundation              General                                           1                     Critical       926052400: #960012: Finished loading antivirus scanner. Error -2147352567.               63b252be-fe7b-4064-9547-4ca59a442368

00:20.8      w3wp.exe (0x3660)                                        0x4238       SharePoint Foundation              General                                           1                     Critical       1719104822: #960013: Antivirus scanner timed out.      8f34e5bb-f838-4f1f-a2f1-8753eae983b2

00:20.8      w3wp.exe (0x3660)                                        0x4238       SharePoint Foundation              Runtime                                         tkau              Unexpected                        System.Runtime.InteropServices.COMException: Exception from HRESULT: 0x80041054    at Microsoft.SharePoint.Library.SPRequestInternalClass.GetFileAndMetaInfo(String bstrUrl, Byte bPageView, Byte bPageMode, Byte bGetBuildDependencySet, String bstrCurrentFolderUrl, Int32 iRequestVersion, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean& pbGhostedDocument, Boolean& pbDefaultToPersonal, Boolean& pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, Byte& pVerGhostedSetupPath, UInt32& pdwPartCount, Object& pvarMetaData, Object& pvarMultipleMeetingDoclibRootFolders, String& pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllLis...                        8f34e5bb-f838-4f1f-a2f1-8753eae983b2

Event Viewer Logs:

--------------------

Log Name:      Application

Source:        Microsoft Forefront Protection

Date:          12/27/2012 9:01:11 AM

Event ID:      7054

Task Category: Health Status

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      

Description:

The SharePoint service is running but the Forefront VSAPI Library is not registered.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft Forefront Protection" />

    <EventID Qualifiers="49152">7054</EventID>

    <Level>2</Level>

    <Task>7</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2012-12-27T09:01:11.000000000Z" />

    <EventRecordID>761016</EventRecordID>

    <Channel>Application</Channel>

    <Computer></Computer>

    <Security />

  </System>

  <EventData>

  </EventData>

</Event>

Additional Information for root cause

===========================

The VSAPI (Virus Scanning API) is a way for Microsoft products to interface with Anti-Virus products. This takes the form of a DLL, in Forefronts’ case this is “SPVsapi.dll”, and is referenced in the SharePoint registry via a Class ID.

This Class ID is registered with Windows and refers to our DLL. This can then be called by any process within Windows.

SharePoint will then call this DLL and load it into all w3wp.exe processes that SharePoint controls, all SharePoint application pools and all apps that use the SharePoint Object Model (OM). This is loaded when the SharePoint object/process is loaded and receives its first call.

We can see the Forefront VSAPI DLL loaded within the w3wp.exe in the following image:-

This can also occur if any of the requirements above are not 100% correct; i.e. the CLSID is incorrect or missing, the DLL is not accessible, the entry within the SharePoint registry is not correctly configured, etc.

The Forefront Controller process runs as a DCOM server:-

A DCOM server will automatically start if any attempt is made to access it. This can happen for various reasons, but normally these are if the Forefront console is started or a monitoring package, such as SCOM, makes a call to this DCOM server.

The entries within the SharePoint registry and all dependencies between SharePoint and Forefront services and processes are removed when “FSCUtility /disable” is run, and recreated when “FSCUtility /enable” is run. As such, when we are faced with situations where we believe that something within this chain is incorrect or the chain is broken for some reason, we request that the customer runs “FSCUtility /disable” followed by “FSCUtility /enable” as this will force all the chain to be recreated.