DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 961926 - Last Review: July 1, 2009 - Revision: 1.0

SYMPTOMS

Microsoft Forefront Security for Exchange Server may detect Microsoft Office 2007 files as containing an UnwritableCompressedFile virus. This issue occurs if you have a file filter enabled that matches one or more of the sub-files within the Office 2007 file.

The following detection information is logged in the ProgramLog.txt file:
"INFORMATION: Internet scan found virus:
Folder: <folder detected in>
Message: <message name>
File: < Office 2007 file name>-><file name that matches file filter>
Incident: FILE FILTER= <file filter detection>
State: Detected"

"INFORMATION: Internet scan found virus:
Folder: <folder detected in>
Message: <message name>
File: <Office 2007 file name>
Incident: UnwritableCompressedFile
State: Removed"
The following is an example of detection information that is logged in the ProgramLog.txt file:
"INFORMATION: Internet scan found virus:
Folder: SMTP Messages\inbound
Message: MessageName
File: Office2007FileName.docx->image4.jpeg
Incident: FILE FILTER= *.jpeg
State: Detected"

"INFORMATION: Internet scan found virus:
Folder: SMTP Messages\inbound
Message: MessageName
File: Office2007FileName.docx
Incident: UnwritableCompressedFile
State: Removed"

CAUSE

This problem occurs because Office 2007 files contain sub-files that may match a file filter in Forefront Security for Exchange Server. When this occurs, Forefront Security for Exchange Server removes the sub-file and replaces it with the standard deletion text. This causes Office 2007 files to be detected as an UnwritableCompressedFile virus.

Note An Office 2007 file contains several sub-files. These sub-files are considered to be part of the structure of the Office 2007 file.

RESOLUTION

To resolve this issue, install Forefront Security for Exchange Server Service Pack 2 (SP2).

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
960465  (http://support.microsoft.com/kb/960465/ ) Description of Forefront Security for Exchange Server with Service Pack 2

APPLIES TO
  • Microsoft Forefront Security for Exchange Server Service Pack 1, when used with:
    • Microsoft Forefront Security for Exchange Server
Keywords: 
kbqfe kbprb kbexpertiseinter kbsurveynew KB961926
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support