CaseWare files are detected as unscannable with the error message "CSAPI DEC result: 0xA. A malformed container is detected at location CaseWareDocument"

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

A business application called CaseWare from CaseWare International sends files as attachments via e-mail. When scanned by Symantec Mail Security for Microsoft Exchange (SMSMSE) the attachment receives an "unscannable" verdict. The attachments are quarantined or deleted depending on the action configured.

The following Event is reported in the Windows Application Event log for each of these unscannable items:

 

Type: Warning
Date: 
Time: 
Event: 218
Source: Symantec Mail Security for Microsoft Exchange
Category: Unscannable
Description:
The attachment "sample.ac_" located in message with subject "Sample File", located in SMTP has violated the following policy settings:
Scan: Auto-Protect
Rule: Unscannable File Rule
The following actions were taken on it:
The attachment "sample.ac_" was Quarantined for the following reason(s):
Scan Engine Error.  CSAPI DEC result: 0xA. A malformed container is detected at location CaseWareDocument

Cause

SMSMSE attempts to open the attachment and scan the individual parts.  SMSMSE is not handling the CaseWare file formats and marking the attachment as unscannable.

Resolution

This issue is resolved in SMSMSE 6.5.5, upgrade to SMSMSE 6.5.5 to resolve this problem.

Workaround

See the following article for potential workarounds: What criteria can cause an "unscannable file" violation within Symantec products for Microsoft Exchange?