> Source: [sk184548](https://support.checkpoint.com/results/sk/sk184548)

# sk184548 - ESOD fails with "Mobile Access Portal Agent internal error (code 70)"

| Property | Value |
|----------|-------|
| Solution ID | sk184548 |
| Date Created | 2026-03-12 |
| Last Modified | 2026-03-15 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * When users attempt to access the Mobile Access Portal, the Endpoint Compliance scan by Endpoint Security On Demand (ESOD), starts but progresses very slowly on some client machines.  
  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk184548/esod_slow_p202602251806412.png)  
* After approximately 3 minutes, the following error appears and users cannot proceed to the login page:  
  `Mobile Access Portal Agent internal error (code 70)`  
  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk184548/esod_70_err202602251806251.png)  

* CShell logs (`%temp%\cshell\cshell.elg`) show slow progress between scan stages.  

  `22/12/2025 17:56:06 INFO [global] (Log log) [CShell] CSHELL CALLBACK - cb type = 1, (3 args) `  
  `22/12/2025 17:56:06 INFO [global] (Log log) [CShell] args[0] = ics_progress_callback `  
  `22/12/2025 17:56:06 INFO [global] (Log log) [CShell] args[1] = 103 `  
  `22/12/2025 17:56:06 INFO [global] (Log log) [CShell] args[2] = Win32.Trojan.DownLoader.6400 `  
  `22/12/2025 17:56:06 INFO [global] (Log log) [CShell] Calling JS: ics_progress_callback `  
  `22/12/2025 17:56:06 INFO [global] (Log log) [CShell] CshellCallback: retVal = 0 `  
  `22/12/2025 17:56:06 INFO [CShellHTTPHandler] (CShellHTTPHandler proceedHandleRequest) Method name: getJSResults `  
  `22/12/2025 17:56:06 INFO [CShellHTTPHandler] (CShellHTTPHandler proceedHandleRequest) Method name: getJSResults `  
  `22/12/2025 17:56:06 INFO [CShellHTTPHandler] (CShellHTTPHandler proceedHandleRequest) Method name: getJSResults `  

  `...............................`  

  `22/12/2025 17:57:01 INFO [CShellHTTPHandler] (CShellHTTPHandler proceedHandleRequest) Method name: getJSResults `  
  `22/12/2025 17:57:01 INFO [global] (Log log) [CShell] CSHELL CALLBACK - cb type = 1, (3 args) `  
  `22/12/2025 17:57:01 INFO [global] (Log log) [CShell] args[0] = ics_progress_callback `  
  `22/12/2025 17:57:01 INFO [global] (Log log) [CShell] args[1] = 104 `  
  `22/12/2025 17:57:01 INFO [global] (Log log) [CShell] args[2] = Win32.Trojan.Spy.Goldun.kj `  
  `22/12/2025 17:57:01 INFO [global] (Log log) [CShell] Calling JS: ics_progress_callback `  
  `22/12/2025 17:57:01 INFO [global] (Log log) [CShell] CshellCallback: retVal &nb`

## Cause

This is not a Check Point issue. This behavior occurs when third-party security or endpoint protection software on the client machine interferes with the ESOD scanning process. These products can inject into or heavily monitor javaw.exe (the process responsible for ESOD scanning), significantly slowing down ESOD operations and leading to a portal-side timeout (error 70).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content