QPACK Files are Marked as Unscannable With Error Message "Scan Engine Error. CSAPI DEC result: 0xA. A malformed container is detected."

Article:TECH157614  |  Created: 2011-04-07  |  Updated: 2014-05-02  |  Article URL http://www.symantec.com/docs/TECH157614
Article Type
Technical Solution

Product(s)

Issue



A business application is generating and sending QPACK files as attachments via e-mail. When scanned by Symantec Mail Security for Microsoft Exchange (SMSMSE) the attachment receives an "unscannable" verdict. The attachments are quarantined or deleted depending on the action configured.

 

Conditions

  • File is encoded with ZIP encoding.

1. Save the attachment to the file system.
2. Rename the file as a .ZIP extension.
3. Open with Windows explorer or Winzip.  Ensure the file opens correctly.

 

 


Error



  • The following Event is reported in the Windows Application Event log for each of these unscannable items:

Type: Warning
Date: 
Time: 
Event: 218
Source: Symantec Mail Security for Microsoft Exchange
Category: Unscannable
Description:
The attachment "Pack.QPACK" located in message with subject "Sample File", located in SMTP has violated the following policy settings:
Scan: Auto-Protect
Rule: Unscannable File Rule
The following actions were taken on it:
The attachment "Pack.QPACK" was Quarantined for the following reason(s):
Scan Engine Error.  CSAPI DEC result: 0xA. A malformed container is detected at location Pack.QPACK

 

 

 

 


Environment



  • SMSMSE 6.5.2 and earlier.

Cause



SMSMSE attempts to open the attachment and scan the individual parts.  SMSMSE is not handling the QPACK file formats and marking the attachment as unscannable.


Solution



Upgrade to SMSMSE 6.5.5 or later.


Attachments

Example file.
Pack.qpack (7 kBytes)


Article URL http://www.symantec.com/docs/TECH157614


Terms of use for this information are found in Legal Notices