DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 961926 - Last Review: January 16, 2015 - Revision: 2.0

This article has been archived. It is offered "as is" and will no longer be updated.
This article has been archived. It is offered "as is" and will no longer be updated.

Symptoms

Microsoft Forefront Security for Exchange Server may detect Microsoft Office 2007 files as containing an UnwritableCompressedFile virus. This issue occurs if you have a file filter enabled that matches one or more of the sub-files within the Office 2007 file.

The following detection information is logged in the ProgramLog.txt file:
"INFORMATION: Internet scan found virus:
Folder: <folder detected in>
Message: <message name>
File: < Office 2007 file name>-><file name that matches file filter>
Incident: FILE FILTER= <file filter detection>
State: Detected"

"INFORMATION: Internet scan found virus:
Folder: <folder detected in>
Message: <message name>
File: <Office 2007 file name>
Incident: UnwritableCompressedFile
State: Removed"
The following is an example of detection information that is logged in the ProgramLog.txt file:
"INFORMATION: Internet scan found virus:
Folder: SMTP Messages\inbound
Message: MessageName
File: Office2007FileName.docx->image4.jpeg
Incident: FILE FILTER= *.jpeg
State: Detected"

"INFORMATION: Internet scan found virus:
Folder: SMTP Messages\inbound
Message: MessageName
File: Office2007FileName.docx
Incident: UnwritableCompressedFile
State: Removed"

Cause

This problem occurs because Office 2007 files contain sub-files that may match a file filter in Forefront Security for Exchange Server. When this occurs, Forefront Security for Exchange Server removes the sub-file and replaces it with the standard deletion text. This causes Office 2007 files to be detected as an UnwritableCompressedFile virus.

Note An Office 2007 file contains several sub-files. These sub-files are considered to be part of the structure of the Office 2007 file.

Resolution

To resolve this issue, install Forefront Security for Exchange Server Service Pack 2 (SP2).

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
960465  (http://support.microsoft.com/kb/960465/ ) Description of Forefront Security for Exchange Server with Service Pack 2

Applies to
  • Microsoft Forefront Security for Exchange Server Service Pack 1, when used with:
    • Microsoft Forefront Security for Exchange Server
Keywords: 
kbnosurvey kbarchive kbqfe kbprb kbexpertiseinter kbsurveynew KB961926
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support