Forefront Security for Exchange Server may detect Office 2007 files as containing an UnwritableCompressedFile virus

Article translations Article translations
Article ID: 961926 - View products that this article applies to.
Expand all | Collapse all

SYMPTOMS

Microsoft Forefront Security for Exchange Server may detect Microsoft Office 2007 files as containing an UnwritableCompressedFile virus. This issue occurs if you have a file filter enabled that matches one or more of the sub-files within the Office 2007 file.

The following detection information is logged in the ProgramLog.txt file:
"INFORMATION: Internet scan found virus:
Folder: <folder detected in>
Message: <message name>
File: < Office 2007 file name>-><file name that matches file filter>
Incident: FILE FILTER= <file filter detection>
State: Detected"

"INFORMATION: Internet scan found virus:
Folder: <folder detected in>
Message: <message name>
File: <Office 2007 file name>
Incident: UnwritableCompressedFile
State: Removed"
The following is an example of detection information that is logged in the ProgramLog.txt file:
"INFORMATION: Internet scan found virus:
Folder: SMTP Messages\inbound
Message: MessageName
File: Office2007FileName.docx->image4.jpeg
Incident: FILE FILTER= *.jpeg
State: Detected"

"INFORMATION: Internet scan found virus:
Folder: SMTP Messages\inbound
Message: MessageName
File: Office2007FileName.docx
Incident: UnwritableCompressedFile
State: Removed"

CAUSE

This problem occurs because Office 2007 files contain sub-files that may match a file filter in Forefront Security for Exchange Server. When this occurs, Forefront Security for Exchange Server removes the sub-file and replaces it with the standard deletion text. This causes Office 2007 files to be detected as an UnwritableCompressedFile virus.

Note An Office 2007 file contains several sub-files. These sub-files are considered to be part of the structure of the Office 2007 file.

RESOLUTION

To resolve this issue, install Forefront Security for Exchange Server Service Pack 2 (SP2).

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
960465 Description of Forefront Security for Exchange Server with Service Pack 2

Properties

Article ID: 961926 - Last Review: July 1, 2009 - Revision: 1.0
APPLIES TO
  • Microsoft Forefront Security for Exchange Server Service Pack 1, when used with:
    • Microsoft Forefront Security for Exchange Server
  • Microsoft Forefront Security for Exchange Server
Keywords: 
kbqfe kbprb kbexpertiseinter kbsurveynew KB961926

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com