Video Screencast Help
Symantec Appoints Michael A. Brown CEO. Learn more.

Mail Security unable to scan emails with PDF attachments

Created: 11 Sep 2013 • Updated: 18 Sep 2013 | 9 comments
This issue has been solved. See solution.

I am running Mail Security for Exchange 7.0.0.63 on Exchange Server 2007. A large number of emails with PDF attachments routinely get quarantine because mail security is unable to scan them, yet other emails with PDF attchments are ok. Because of this problem I've been forced to set the Unscannable Rule to "log only", which obviously increases the risk to my users.

Is this a "bug" in the software? If so, is there a fix? 

Thank you

 

 

Operating Systems:

Comments 9 CommentsJump to latest comment

Larry Hornibrook's picture

Same problem, running  new install ver 7.0.1.66 on exchange 2010. Any help here?

Thank You

TSE-JDavis's picture

When you look in the Application log, what is the reason that these are marked unscannable?

Larry Hornibrook's picture

This is a NEW install, and I have set the "Unscanable Rule" to log only.  It has NOT posted any errors.  So there are NO errors in the APP log to find.

TSE-JDavis's picture

You may be looking in the wrong place, Mail Security for Exchange will always log an event any time the unscannable rule is triggered. As you stated, it is set to log only.

This KB document has an example of one of the events you would see in the Windows Application Log:

http://www.symantec.com/business/support/index?pag...

L.S.'s picture

You can specifically exempt *.pdf from the unscannable file rule utilizing the article below.

How to allow malformed containers with Symantec Mail Security for Microsoft Exchange (SMSMSE) 6.5.5 or later - Article URL http://www.symantec.com/docs/HOWTO59051

The only events that are not logged by SMSMSE by default are the Spam detection categories. I would recommend enabling logging for Spam and suspect spam and seeing if an event is triggered when the message comes through.  Otherwise, if no event is triggered in the Windows Application Event Log, then SMSMSE did not take action on the message.

I would also recommend using version 7.0.1.66 instead.  Some unrelated fixes have been implimented and it would also ensure you are utilizing the latest decomposer for the processing of those PDF files.

SOLUTION
Leonardo Fernandez 2's picture

I added the reg entries described in the article to my two hub transports about 2 hours ago. I had them in there previously, but I guess the upgrade from 6.5 to 7 removed them. So far no unscannable PDFs.

Larry Hornibrook's picture

this is the error i'm getting:

 

The following actions were taken on it:

                The attachment "name.pdf" was Quarantined for the following reason(s):

Scan Engine Error.  CSAPI DEC result: 0xA. A malformed container is detected. Engine Name: PDF.

 

does the above solution work for this?

L.S.'s picture

Yes, the above solution would allow you to exempt specific file types, such as .pdf, from the unscannable file rule.

Again, it would be recommended to ensure you are utilizing the latest version of SMSMSE so you have access to the latest decomposer version.