How to troubleshoot Decomposer / 17 scan errors from Scan Engine 5.x
|Article:TECH95356|||||Created: 2009-01-04|||||Updated: 2010-01-19|||||Article URL http://www.symantec.com/docs/TECH95356|
After scanning an archive file, Microsoft Office file, or other container file, Scan Engine records a Decomposer / 17 scan error pair in its logs. You seek to determine why, and if possible, scan the file again without error.
Decomposer / 17 - RESULT_OPEN_CONTAINER_FAILED Scan Engine identified the file as an archive or container file, but was not able to open the file as an archive. There are multiple possible underlying causes for this condition. - The archive was corrupted during transmission. - The archive was corrupted as a result of exhausting available space in the filesystem location or share where it was written. - The archive was not properly constructed by the application which created it. - Following the creation of the archive, another application altered the archive improperly. Note that in the case of each condition above, Scan Engine is acting by design when it is not able to open the file and when it logs a Decomposer / 17 scan error.
- Upgrade to the most recent version of Scan Engine 5.x. Re-scan the file with the same connector.
- Copy the file to the local filesystem where Scan Engine is installed. Set Scan Engine to ICAP protocol. Re-scan file with the ssecls command line scanner.
- If the file triggering the Decomposer / 17 scan error is an Office document, or a classic archive file (.zip, .rar., .tar.gz, etc), then perform divide and conquer methodology to determine which part or parts of the file cause Scan Engine to fail to open the archive.
Title: Using divide and conquer methods with container files that cause scan errors
Article URL http://www.symantec.com/docs/TECH95356