Forefront Security for SharePoint cleans infected documents even though the "Attempt to clean infected documents" option in SharePoint is not selected

This article has been archived. It is offered "as is" and will no longer be updated.
Symptoms
Consider the following scenario:
  • You are running Microsoft Forefront Security for SharePoint on a SharePoint server.
  • In Forefront Administrator, you select Clean: repair document in the Antivirus settings.
  • In SharePoint Central Administrator, you clear the Attempt to clean infected documents check box in the Antivirus settings.
  • You try to upload an infected document to the SharePoint Web site.
In this scenario, Forefront Security for SharePoint unexpectedly cleans the document. This means the SharePoint Antivirus setting is not honored.
Cause
This problem occurs because the SharePoint Attempt to clean infected documents option does not take precedence over the Forefront Security for SharePoint Action setting for each scan job. This problem occurs in versions of Forefront Security for SharePoint that are earlier than Service Pack 3.
Resolution
To resolve this issue, install Forefront Security for SharePoint with Service Pack 3 (SP3). For more information, click the following article number to view the article in the Microsoft Knowledge Base:
967995 Description of Forefront Security for SharePoint with Service Pack 3
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
More information

Steps to reproduce the problem

  1. In Forefront Administrator, click Settings, and then click Antivirus. Click to highlight any of the scan jobs, and then set the Action to Clean: repair document.
  2. In SharePoint Central Administrator, follow these steps:
    1. Click Operations.
    2. In the Operation pane, under Security Configuration, click Antivirus.
    3. In the Antivirus pane, click to clear the option to Attempt to clean infected documents, and then click Save.
  3. Upload an infected document to the SharePoint Web site.
FSSP SP3
Properties

Article ID: 969043 - Last Review: 01/15/2015 11:02:02 - Revision: 2.0

Microsoft Forefront Security for SharePoint, Microsoft Forefront Security for SharePoint Service Pack 1, Microsoft Forefront Security for SharePoint Service Pack 2

  • kbnosurvey kbarchive kbexpertiseinter kbbug kbqfe kbsurveynew kbprb KB969043
Feedback