Select the product you need help with

Forefront Security for SharePoint may detect that 2007 Office files contain the UnwritableCompressedFile virus

Article ID: 968169 - View products that this article applies to.

SYMPTOMS

Microsoft Forefront Security for SharePoint may detect that Microsoft 2007 Office files contain the UnwritableCompressedFile virus. This issue occurs if you have a Forefront file filter enabled, and file filter criteria matches one or more of the subfiles in the 2007 Office file.

In this case, the following detection information is logged in the ProgramLog.txt file:

"INFORMATION: Realtime scan found virus:
Folder: *During Scanning*
Message: : <message name>
File: <Office 2007 file name>-><file name that matches file filter>
Incident: FILE FILTER= <file filter detection>
State: Detected"

"INFORMATION: Realtime scan found virus:
Folder: *During Scanning*
Message: <message name>
File: <Office 2007 file name>
Incident: UnwritableCompressedFile
State: Removed"

For example, the log information resembles the following:

"INFORMATION: Realtime scan found virus:
Folder: *During Scanning*
Message: MessageName
File: Office2007FileName.docx->image4.jpeg
Incident: FILE FILTER= *.jpeg
State: Detected"

"INFORMATION: Realtime scan found virus:
Folder: *During Scanning*
Message: MessageName
File: Office2007FileName.docx
Incident: UnwritableCompressedFile
State: Removed"

Back to the top | Give Feedback

CAUSE

This problem occurs because 2007 Office files contain subfiles that match file filter criteria in Forefront Security for SharePoint. In this case, Forefront Security for SharePoint removes the subfiles and replaces them with the standard deletion text. This causes Forefront Security for SharePoint to determine that 2007 Office files contain an UnwritableCompressedFile virus.

Note An 2007 Office file contains several subfiles. These subfiles are considered part of the structure of the 2007 Office file.

Back to the top | Give Feedback

RESOLUTION

To resolve this problem, install Forefront Security for SharePoint Service Pack 3 (SP3). For more information, click the following article number to view the article in the Microsoft Knowledge Base:

967995

(http://support.microsoft.com/kb/967995/ )

Description of Forefront Security for SharePoint with Service Pack 3

Back to the top | Give Feedback