Some Microsoft Word document files (*.doc) are treated as 'unscannable' by Symantec Mail Security for Microsoft Exchange

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

Some Microsoft Word document files (*.doc) are treated as 'unscannable' by Symantec Mail Security for Microsoft Exchange, what can be done to correct this?

Symptoms
Windows Application Event Log contains the following Error Events:

 

Event ID 218 from Source Symantec Mail Security for Microsoft Exchange with this text in the description:

Scan Engine Error: CSAPI DEC result 0x11. Decomposer failed to open the container

Conditions

The file was created in Microsoft Office Word 2007, and then saved as a 97-2003 Word document.


 

Cause

Word documents in 2007 are actually container files, and when certain options are selected (the full list of these options is unknown at this time) files are placed within the container file. Because the file is saved as 2003 compatible, and 2003 Word documents were not container files, the Decomposer engine in Symantec Mail Security for Microsoft Exchange (SMSMSE) is unable to open the file using the algorithm that normally works for 2003, as the file is actually a container file.

Resolution

Please provide samples of these files to Symantec Technical support if possible. We are working to identify all possible formatting options that can trigger this error and fix the Decomposer engine to be more robust in dealing with these types of files.

Workaround

Use the .docx format for Microsoft Word 2007 files.

See the following KB article for other workarounds as well as other details on unscannable conditions from SMSMSE: What criteria can cause an "unscannable file" violation within Symantec products for Microsoft Exchange?.