Spam Filter ISP Forums : SpamFilter CRASH https://www.logsat.com/spamfilter/forums/ Wed, 10 Jun 2026 15:13:07 +0000 Tue, 23 Dec 2014 19:10:33 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=7106 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[SpamFilter CRASH : We received the files, thank you.There...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7106&PID=14690&title=spamfilter-crash#14690 Author: LogSat
Subject: 7106
Posted: 23 December 2014 at 7:10pm

We received the files, thank you. 

There seems to be an access violation (0xc0000005) within the C:\Windows\SYSTEM32\ntdll.dll, that is then in turn causing SpamFilter to crash. Do you have access to a different version of the NTDLL.dll file that you can try using?

Alternatively, you could try running the 32bit version of SpamFilter instead of the 64bit version one. You can download the x86 version of the binaries from our website after logging in. Please note that you will need to replace the both the SpamFilter.exe and the SpamFilterSvc.exe, along with the two DLL files libeay32.dll and ssleay32.dll from the .zip file containing the 32bit (x86) version of SpamFilter. Lastly, depending on how you constructed the connection string to the database, you may need to use the 32-bit ODBC administrator to create a DSN if you used one.

As a side note, while I do not believe this is the cause of the problems, fFrom SpamFilter's logfile we see that SpamFilter is sometimes started as a service (the executable in Task Manager is SpamFilterSvc.exe), and sometimes instead the standalone version of SpamFilter (SpamFilter.exe) is instead launched:

12/22/14 15:28:50:224 -- SpamFilter ISP v4.6.0.113 Listening on all IPs port 25 (64bit standalone mode)
12/22/14 15:28:57:849 -- SpamFilter ISP v4.6.0.113 Listening on all IPs port 25 (64bit service mode)


In addition, there are some instances where one version of SpamFilter is launched (for example the standalone version) while the other one (for ex the windows service) is already running:
12/22/14 17:07:00:501 -- SpamFilter ISP v4.6.0.113 Listening on all IPs port 25 (64bit service mode)
12/22/14 17:07:09:122 -- SpamFilter ISP v4.6.0.113 Listening on all IPs port 25 (64bit standalone mode)
12/22/14 17:07:13:044 -- Exception occurred during PerformPostStartupTasks: Could not bind socket. Address and port are already in use.

When this happens there is a conflict leading to undetermined issues, as both applications will be fighting for the same resources and trying to listen on the same port.


]]> Tue, 23 Dec 2014 19:10:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7106&PID=14690&title=spamfilter-crash#14690 <![CDATA[SpamFilter CRASH : Paolo,Can you pleasezip us the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7106&PID=14688&title=spamfilter-crash#14688 Author: LogSat
Subject: 7106
Posted: 22 December 2014 at 3:44pm

Paolo,

Can you please zip us the following so we can take a look:

• SpamFilter's activity logfile for today

• Your SpamFilter.ini file

• The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well.


If the zipped file is over 8MB in size, I'll send you via a PM the credentials to upload the files to our website.

]]> Mon, 22 Dec 2014 15:44:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7106&PID=14688&title=spamfilter-crash#14688 <![CDATA[SpamFilter CRASH : Hallo,I have a brand new Spam...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7106&PID=14687&title=spamfilter-crash#14687 Author: PAP400
Subject: 7106
Posted: 22 December 2014 at 1:39pm

Hallo,

I have a brand new Spam Filter for ISP 4.6.0.113 on a Windows 2012R2 STD.
It's been working for 3 days, then it started to crash continuously every 10 minutes and 5/6 seconds with the following windows logs:

SYSTEM
The SpamFilter service terminated unexpectedly.  It has done this xx time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service

APPLICATION
Faulting application name: SpamFilterSvc.exe, version: 4.6.0.113, time stamp: 0x539afcf6
Faulting module name: ntdll.dll, version: 6.3.9600.17278, time stamp: 0x53eebd22
Exception code: 0xc0000005
Fault offset: 0x0000000000093592
Faulting process id: 0x2698
Faulting application start time: 0x01d01e0ff4ad68b8
Faulting application path: C:\Program Files\SpamFilter\SpamFilterSvc.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 76ab46e5-8a04-11e4-80c9-40f2e9f70681
Faulting package full name:
Faulting package-relative application ID:

Because of the "access violation" I've tried to:
- Inhibit Antivirus to check SpamFilterSvc.exe activity (latest SEP 12.1.5)
- Inhibit Antivirus to check SpamFilter application folder, subfolders and files
- Inhibit Antivirus to check quarantine SQL Server files and folders
- Deactivate real-time antivirus check at all (!)
- Launche SpamFilter as an application (Spamfilter.exe)
- Activate UI0Detect changing the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows\NoInteractiveServices key

Nothing changed
No special log before crash

The only other service installed is an IBM Domino 9.01 with some related add-in task.

I have no idea on what happens every 10 minutes (and 5~6 seconds): do you have some?

Thank you

Paolo Pallara


Edited by PAP400 - 22 December 2014 at 1:40pm]]> Mon, 22 Dec 2014 13:39:41 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7106&PID=14687&title=spamfilter-crash#14687