Reducing the incidence of malformed MIME false positives
|Article:HOWTO82510|||||Created: 2012-11-30|||||Updated: 2014-06-25|||||Article URL http://www.symantec.com/docs/HOWTO82510|
A message body or attachment might trigger the Unscannable File Rule and appear in the Event Log as Event ID 218. However, the MIME container in the email appears to be correct.
You can either reduce the sensitivity for malformed MIME identification or disable detection of malformed MIME containers to reduce the incidence of malformed MIME false positives.
To reduce malformed MIME identification sensitivity
Create or modify the following DWORD registry value:
The value can be a decimal between 1 and 5. The higher the number, the lower the sensitivity, which reduces the incidence of false positives.
Article URL http://www.symantec.com/docs/HOWTO82510