Virus file is shown in quarantine page although Symantec Protection for SharePoint (SPSS) failed to quarantine the file as it is locked by workflow process.

book

Article ID: 158807

calendar_today

Updated On:

Products

Protection for SharePoint Servers

Issue/Introduction

SPSS detected virus file and the file is shown under the quarantine page. However the file is not deleted from the document library once accessed, and also does not appear under Quarantine folder. The statistics on "files got quarantined" does not get updated as well.

Similar error can be found under process log:

"yyyy-mm-dd hh:mm:ss","Warning","Process","https://<server>/virus test file.txt"," (null)","Scan","Manual","InfectedNoRepair","CopyQuartineAndDelete","68","0","The infected unrepairable file was quarantined and then deleted.","1","1 -Infected files: virus test file.txt -Infections: <virus name> -Status: Deleted","virus test file.txt|<virus name>|NONE|11101"

Similar line can be found under debugview log:

00000318 50.46093369 [2636] Exception 1:112226fc-3a8d-4cab-9428-

42f65041c6f7 >> 

Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) 

Cause

Workflow process like Record management software (for example: RecordPoint) locks the virus file and causes SPSS to fail to quarantine the file. However the quarantine page incorrectly reports the file is quarantined.

Resolution

The issue was fixed on version 6.0.5. Upgrade to version 6.0.5 to resolve this problem.


Applies To

Product Version: SPSS 6.0.4, SPE 7.0.1.1

Platform: Windows Server 2008 R2, 

Platform Version : Enterprise (x64-64bit)