Forefront Security for Exchange Server may detect Office 2007 files as containing an UnwritableCompressedFile virus

Article translations Article translations
Article ID: 961926 - View products that this article applies to.
This article has been archived. It is offered "as is" and will no longer be updated.
This article has been archived. It is offered "as is" and will no longer be updated.
Expand all | Collapse all

Symptoms

Microsoft Forefront Security for Exchange Server may detect Microsoft Office 2007 files as containing an UnwritableCompressedFile virus. This issue occurs if you have a file filter enabled that matches one or more of the sub-files within the Office 2007 file.

The following detection information is logged in the ProgramLog.txt file:
"INFORMATION: Internet scan found virus:
Folder: <folder detected in>
Message: <message name>
File: < Office 2007 file name>-><file name that matches file filter>
Incident: FILE FILTER= <file filter detection>
State: Detected"

"INFORMATION: Internet scan found virus:
Folder: <folder detected in>
Message: <message name>
File: <Office 2007 file name>
Incident: UnwritableCompressedFile
State: Removed"
The following is an example of detection information that is logged in the ProgramLog.txt file:
"INFORMATION: Internet scan found virus:
Folder: SMTP Messages\inbound
Message: MessageName
File: Office2007FileName.docx->image4.jpeg
Incident: FILE FILTER= *.jpeg
State: Detected"

"INFORMATION: Internet scan found virus:
Folder: SMTP Messages\inbound
Message: MessageName
File: Office2007FileName.docx
Incident: UnwritableCompressedFile
State: Removed"

Cause

This problem occurs because Office 2007 files contain sub-files that may match a file filter in Forefront Security for Exchange Server. When this occurs, Forefront Security for Exchange Server removes the sub-file and replaces it with the standard deletion text. This causes Office 2007 files to be detected as an UnwritableCompressedFile virus.

Note An Office 2007 file contains several sub-files. These sub-files are considered to be part of the structure of the Office 2007 file.

Resolution

To resolve this issue, install Forefront Security for Exchange Server Service Pack 2 (SP2).

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
960465 Description of Forefront Security for Exchange Server with Service Pack 2

Properties

Article ID: 961926 - Last Review: January 16, 2015 - Revision: 2.0
Applies to
  • Microsoft Forefront Security for Exchange Server Service Pack 1, when used with:
    • Microsoft Forefront Security for Exchange Server
  • Microsoft Forefront Security for Exchange Server
Keywords: 
kbnosurvey kbarchive kbqfe kbprb kbexpertiseinter kbsurveynew KB961926

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com