Video Screencast Help

Failed to quarantine attachment

Created: 08 Feb 2008 • Updated: 21 May 2010 | 3 comments
Hi,
 
I'v just upgraded our Mail Security for Exchange to version 6 (on Exchange 2003).  I now have an error in the event log that an e-mail message has violated the Unscannable File rule.  I have set it up to move this message to quarantine but there is another message that says the SMS failed to quarantine the attachment.  Also, the event log shows that the process SAVFMSESp.exe was restarted.
 
I am getting repeated e-mails about this.
 
I find it strange though that the e-mail did make it through, with its attachment, to the recepient.  I took a look at the e-mail and there is nothing apparent to me that would trigger the Unscannable File rule.
 
Has anyone else seen this before?  How can I fix it?
Discussion Filed Under:

Comments 3 CommentsJump to latest comment

safesystems's picture

I am having this exact same problem.  Any help would be much appreciated.

J Breaker's picture
I was able to talk to Symantec support.
 
I was told that because I did an in place upgrade from 4.5 and did not do a fresh install, there may be some reg keys or files that could be causing the problem.
 
I uninstalled Mail Security Version 6 and then I used the following document to remove all traces.
 
Manual Removal 6.0 for Exchange 2000/2003

     http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2007550038993498   

 
Afterwards I did a completely new install and so far everything is working as expected.
 
 
 
TonyF666's picture

I am getting similar messages. I am relatively new to MS Exchange and Symantec Mail Security.  I installed MS Exchange 2003 and Symantec Mail Security 6.0.5.218 back in May 2008.  I have since upgraded Mail Security to 6.0.6.235

 

I believe there are a couple of emails that are stuck in limbo someplace since I keep receiving the same emails and error messages about them every day for months.

 

Here's the email notification I get from Mail Security:

 

Subject:

 Administrator Alert: Symantec Mail Security detected a message with an unscannable attachment or body  

Body:

Location of the message: Tony C. Fantaci/Inbox Sender of the message: aegisuk@ymail.com Subject of the message: AEGIS UK - DOGS WANTED

The attachment(s) "AEGIS UK.JPG" and/or the message was Denied Access.

This was done due to the following Symantec Mail Security settings:

Scan: Auto-Protect

Rule: Unscannable File Rule (User defined action failed - Deny Access used instead)

 

On the Exhange Server in the Event Log here are the 4 corresponding errors for this event:

 

Event Type: Error
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Quarantine
Event ID: 103
Date:  2/18/2009
Time:  10:04:56 AM
User:  N/A
Computer: MAILSERVER
Description:
Failed to quarantine attachment named "AEGIS UK.JPG"  in message with subject "AEGIS UK - DOGS WANTED"  in "Tony C. Fantaci".

 

Event Type: Warning
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Service
Event ID: 168
Date:  2/18/2009
Time:  10:04:57 AM
User:  N/A
Computer: MAILSERVER
Description:
The process SAVFMSESp.exe was restarted.

 

Event Type: Warning
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Service
Event ID: 168
Date:  2/18/2009
Time:  10:04:57 AM
User:  N/A
Computer: MAILSERVER
Description:
The process SAVFMSESp.exe was restarted.

 

Event Type: Warning
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Unscannable
Event ID: 218
Date:  2/18/2009
Time:  10:05:55 AM
User:  N/A
Computer: MAILSERVER
Description:
The attachment "AEGIS UK.JPG" located in message with subject "AEGIS UK - DOGS WANTED", located in Tony C. Fantaci/Inbox has violated the following policy settings:
 Scan: Auto-Protect
 Rule: Unscannable File Rule (User defined action failed - Deny Access used instead)
The following actions were taken on it:
 The attachment "AEGIS UK.JPG" was Denied Access for the following reason(s):
Scan Engine error. Error code: 0x80004005

 

Can anyone please help me rectify this situation?

Thanks!!