PowerPoint Documents Called Unscannable by Symantec Mail Security for Microsoft Exchange (SMSMSE) 6.5.5 with Decomposer Result 0x11

Article:TECH160836

Created: 2011-05-25

Updated: 2011-09-21

Article URL http://www.symantec.com/docs/TECH160836

NOTE: If you are experiencing this particular known issue, we recommend that you to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.

Article Type
Technical Solution

Product(s)

Show all

Languages

Show all

Problem

SMSMSE is unable to scan certain Microsoft PowerPoint files. These files are quarantined by SMSMSE.

Conditions

These files can be opened successfully with PowerPoint
Debugview logs show the following error (How to obtain a DebugView log file from Symantec Mail Security for Microsoft Exchange):

    14:44:38.604 [7036] SAVFMSESp(1B7C)[1258] 2011-05-13 14:44:38 0557ms:
    14:44:38.604 [7036] ..\..\..\src\Server\SAVFMSEENG\AVEngine.cpp(1640) :
    14:44:38.604 [7036] CSAPI decomposer result code: 10
    14:44:39.072 [7036] SAVFMSESp(1B7C)[1258] 2011-05-13 14:44:38 0589ms:
    14:44:39.072 [7036] ..\..\..\src\Server\SAVFMSEENG\AVEngine.cpp(1689) : 14:44:39.072 [7036] MALFORMED_CONTAINER_DETECTED. Engine name: MIME

Error

The Windows Application Event Log shows the following error event:

Event ID 218
Source: Symantec Mail Security for Microsoft Exchange
Category: Unscannable
The attachment "<file name>.ppt" located in message with subject "<message subject>", located in <location> has violated the following policy settings:
Scan: Auto-Protect
Rule: Unscannable File Rule
The following actions were taken on it:

The attachment "<file name>.ppt" was Quarantined for the following reason(s):

Scan Engine Error. CSAPI DEC result: 0x11. Decomposer failed to open the container. at location PowerPoint Document

Cause

Some Powerpoint files cause the decomposer to trigger a boolean variable value which is handled improperly.

Solution

This issue is resolved in SMSMSE 6.5.6. Upgrade to 6.5.6 to fix this problem. If you are unable to upgrade at this time, you can apply the hotfix listed in the 'Workaround' section of this document.

Workaround

Apply this hotfix.

1. Exit Symantec Mail Security console if it is open.
2. Stop the following services:

Symantec Mail Security for Microsoft Exchange
Symantec Mail Security Utility Service

Click Start -> Run then type services.msc.

3. Rename the following file by appending a .old to the filename:

32-bit OS: C:\Program Files\Common Files\Symantec Shared\definitions\Decomposer\Dec2SS.DLL
64-bit OS: C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\Dec2SS.DLL

4. Copy the attached file Dec2SS.dll from this document to the same location.
5. Start the following services:

Symantec Mail Security for Microsoft Exchange
Symantec Mail Security Utility Service

If you continue to see unscannable detections on PowerPoint files after applying this hotfix open a support case with Symantec. Be prepared to submit copies of the files affected.

Attachments

Dec2SS.DLL (281 kBytes)

Supplemental Materials

Source	ETrack
Value	2381312