PowerPoint Documents Containing Embedded Excel Spreadsheets Marked as Unscannable by Symantec Mail Security for Microsoft Exchange (SMSMSE)

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

Certain PowerPoint files containing embedded Excel spreadsheet content are called unscannable with Scan engine error code 0xA even though these files can be opened in PowerPoint without error.

The Windows Application Event Log shows the following error event:

Event ID 218
Source: Symantec Mail Security for Microsoft Exchange
Category: Unscannable
The attachment "<file name>.ppt" located in message with subject "<message subject>", located in <location> has violated the following policy settings:
 Scan: Auto-Protect
 Rule: Unscannable File Rule
The following actions were taken on it:
 The attachment "<file name>.ppt" was Quarantined for the following reason(s):
Scan Engine Error.  CSAPI DEC result: 0xA. A malformed container is detected. at location Package within PowerPoint Document

 

Conditions

Prior to performing these steps save the file to the filesystem from Quarantine. The file is saved to <install dir>\Symantec\SMSMSE\<version>\Server\Quarantine\Release.

• Powerpoint file is saved as Powerpoint 2003 format.
  
  This condition is met if the file extension is .ppt.
   
• Powerpoint file contains embedded Excel objects.
  
  1. Open the Powerpoint file in Powerpoint.
  2. Find a table in the presentation and right click. 
  3. If the menu shows Worksheet Object as an option then this condition is met.
  
   
• Saving the file as Powerpoint 2007 format and sending through SMSMSE works.
  
  1. Open the file with PowerPoint 2007.
  2. Choose File -> Save as "PowerPoint Presentation" (*.pptx).
  3. Send a copy through Exchange.  If file is not caught as unscannable, this condition is met.

 

Cause

The file is being saved as a 2003 ppt file, but contains some content that is native to 2007 pptx files. When SMSMSE uses the appropriate algorithm to decompose 2003 ppt files but then encounters content native to 2007 pptx files, it declares the file malformed.

Resolution

Upgrade to 6.5.5 or later to resolve this problem.

Workaround

Save the file as a PowerPoint 2007 document (*.pptx) before sending it through email.