PowerPoint Documents Called Unscannable by Symantec Mail Security for Microsoft Exchange (SMSMSE) 6.5.5 with Decomposer Result 0x11

Article:TECH160836  |  Created: 2011-05-25  |  Updated: 2013-10-22  |  Article URL http://www.symantec.com/docs/TECH160836
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution


Issue



SMSMSE is unable to scan certain Microsoft PowerPoint files.  These files are quarantined by SMSMSE.

Conditions


    14:44:38.604 [7036] SAVFMSESp(1B7C)[1258] 2011-05-13 14:44:38 0557ms:
    14:44:38.604 [7036] ..\..\..\src\Server\SAVFMSEENG\AVEngine.cpp(1640) :
    14:44:38.604 [7036]  CSAPI decomposer result code: 10
    14:44:39.072 [7036] SAVFMSESp(1B7C)[1258] 2011-05-13 14:44:38 0589ms:
    14:44:39.072 [7036] ..\..\..\src\Server\SAVFMSEENG\AVEngine.cpp(1689) : 14:44:39.072 [7036] MALFORMED_CONTAINER_DETECTED. Engine name: MIME


 

 


Error



  •  The Windows Application Event Log shows the following error event:

Event ID 218
Source: Symantec Mail Security for Microsoft Exchange
Category: Unscannable
The attachment "<file name>.ppt" located in message with subject "<message subject>", located in <location> has violated the following policy settings:
 Scan: Auto-Protect
 Rule: Unscannable File Rule
 The following actions were taken on it:

 The attachment "<file name>.ppt" was Quarantined for the following reason(s):

Scan Engine Error.  CSAPI DEC result: 0x11. Decomposer failed to open the container. at location PowerPoint Document

 


Cause



 Some Powerpoint files cause the decomposer to trigger a boolean variable value which is handled improperly.


Solution



This issue is resolved in SMSMSE 6.5.6. Upgrade to 6.5.6 to fix this problem. If you are unable to upgrade at this time, you can apply the hotfix listed in the 'Workaround' section of this document.

Workaround

Apply this hotfix.

1. Exit Symantec Mail Security console if it is open.
2. Stop the following services:

Symantec Mail Security for Microsoft Exchange
Symantec Mail Security Utility Service

Click Start -> Run then type services.msc.

3. Rename the following file by appending a .old to the filename:

32-bit OS: C:\Program Files\Common Files\Symantec Shared\definitions\Decomposer\Dec2SS.DLL
64-bit OS: C:\Program Files (x86)\Common Files\Symantec Shared\definitions\Decomposer\Dec2SS.DLL

4. Copy the attached file Dec2SS.dll from this document to the same location.
5. Start the following services:

Symantec Mail Security for Microsoft Exchange
Symantec Mail Security Utility Service

If you continue to see unscannable detections on PowerPoint files after applying this hotfix open a support case with Symantec. Be prepared to submit copies of the files affected.

 


Attachments

Dec2SS.DLL (281 kBytes)

Supplemental Materials

SourceETrack
Value2381312


Article URL http://www.symantec.com/docs/TECH160836


Terms of use for this information are found in Legal Notices