MailMarshal Engine service problems after Sophos for Marshal update

This article applies to:

• Trustwave MailMarshal (SEG) 7.1.0 and below
• Sophos for Marshal 1.0.4

Symptoms:

• MailMarshal Engine unresponsive, or virus scanning fails
• MailMarshal Engine log entries similar to the following:
  3600 16:14:43.410 MSSophos.dll: New Sophos for Marshal engine available. Hash: XXX
  3600 16:14:43.410 MSSophos.dll: Unloading SAVI library.
  3600 16:14:43.410 MSSophos.dll: Re-initialising SAVI.
  3600 16:14:47.191 MSSophos.dll: InitialiseWithMoniker failed: Resetting moniker.
  3600 16:14:47.191 MSSophos.dll: InitialiseWithMoniker still fails with hr(0xa004020b)
  3600 16:14:47.191 MSSophos.dll: Unloading SAVI library.

Causes:

• A new Sophos Engine file was released. Engines are typically released on a monthly cycle and applied automatically.
• In some cases, earlier version of the Sophos for Marshal DLL (MSSophos.dll) which bridges between MailMarshal and Sophos do not reset properly when under mail scanning load.
• Current versions of the Sophos for Marshal DLL do not experience this issue.
  • However, if you upgraded MailMarshal, it is possible that an earlier version of this DLL was re-installed.

Resolution:

To resolve this issue:

1. Ensure that you have installed the latest version of SEG and Sophos for Marshal. This issue is resolved in Sophos for Marshal 1.0.4.9547 and above (MSSophos.dll version 1.3.4.0 and above).
2. Verify the version of MSSophos.dll that is installed in the MailMarshal installation folder.
   • Note: Another file with this name may exist in the Sophos for Marshal folder, but the item of interest is in the MailMarshal install location.
3. Navigate to this file, and view the properties. The version should be at least 1.3.4.0.
   
   
4. If necessary, update MSSophos.dll by running the Sophos for Marshal installer in Repair mode.

Notes:

• SEG 7.1.1 and above corrects the behavior mentioned:
  
  • Upgrading to 7.1.1 or above will not install an older version of MSSophos.dll.
  • 7.1.1 includes the version 1.3.4.0 of this DLL.
• Customers with current maintenance can obtain the latest version of the software from the support section of the Trustwave website.