Decomposer Engine errors when performing AntiVirus scans of plain text files

Products

• Endpoint Protection

Issue/Introduction

Scans take an unusually long time, or you see errors in the operating system log(s) stating that some files were not scanned due to Decomposer errors.


Symptoms
Unusually long scans and high CPU usage by the Rtvscan process; Symantec AntiVirus products may appear to stop responding when scanning some files.

The files involved may appear to be plain text or log files. Manually scanning a single file may result in more than one "Files scanned:" result in the scan progress dialog.

Examples of Windows application log errors:

• "Could not scan [#] files inside [path][filename] due to extraction errors encountered by the Decomposer Engines. Application has encountered an error."
• "Scan Error - decomposer too deep"

 

Cause

Certain sequences of text, colons and carriage returns in otherwise plain text files may match the structure of MIME-encoded files. This format is processed using the same decomposer engine that is used for other compression or archival formats. For example, a large log file with repeating date/time stamps may appear to the decomposer as if it is a large archive of many files or multiple compressed files. An attempt to decompose such a file will of course result in errors because the file is not a genuine archive.

Resolution

The errors do not indicate a malfunction in the product. The decomposer errors cannot be eliminated from system logs; they may be useful in alerting a customer to corrupt archives or deeply-compressed files that should be excluded from scans.

For other causes and solutions, see the related article:
Symantec AntiVirus Error: "Could not scan [#] files inside [path][filename] due to extraction errors encountered by the Decomposer Engines" during a scan