DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 968169 - Last Review: July 1, 2009 - Revision: 1.0

SYMPTOMS

Microsoft Forefront Security for SharePoint may detect that Microsoft 2007 Office files contain the UnwritableCompressedFile virus. This issue occurs if you have a Forefront file filter enabled, and file filter criteria matches one or more of the subfiles in the 2007 Office file.

In this case, the following detection information is logged in the ProgramLog.txt file:
"INFORMATION: Realtime scan found virus:
Folder: *During Scanning*
Message: : <message name>
File: <Office 2007 file name>-><file name that matches file filter>
Incident: FILE FILTER= <file filter detection>
State: Detected"

"INFORMATION: Realtime scan found virus:
Folder: *During Scanning*
Message: <message name>
File: <Office 2007 file name>
Incident: UnwritableCompressedFile
State: Removed"

For example, the log information resembles the following:
"INFORMATION: Realtime scan found virus:
Folder: *During Scanning*
Message: MessageName
File: Office2007FileName.docx->image4.jpeg
Incident: FILE FILTER= *.jpeg
State: Detected"

"INFORMATION: Realtime scan found virus:
Folder: *During Scanning*
Message: MessageName
File: Office2007FileName.docx
Incident: UnwritableCompressedFile
State: Removed"

CAUSE

This problem occurs because 2007 Office files contain subfiles that match file filter criteria in Forefront Security for SharePoint. In this case, Forefront Security for SharePoint removes the subfiles and replaces them with the standard deletion text. This causes Forefront Security for SharePoint to determine that 2007 Office files contain an UnwritableCompressedFile virus.

Note An 2007 Office file contains several subfiles. These subfiles are considered part of the structure of the 2007 Office file.

RESOLUTION

To resolve this problem, install Forefront Security for SharePoint Service Pack 3 (SP3). For more information, click the following article number to view the article in the Microsoft Knowledge Base:
967995  (http://support.microsoft.com/kb/967995/ ) Description of Forefront Security for SharePoint with Service Pack 3

APPLIES TO
  • Microsoft Forefront Security for SharePoint
  • Microsoft Forefront Security for SharePoint Service Pack 1
  • Microsoft Forefront Security for SharePoint Service Pack 2
Keywords: 
kbqfe kbexpertiseinter kbsurveynew kbprb KB968169
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support