Symantec Mail Security for Exchange (SMSMSE) triggers "UFR-Malformed Files" verdict on 7zip files.

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

Certain 7zip files trigger unscannable verdict "UFR-Malformed Files" when it is sent as attachment through SMSMSE.

Windows Application Event log shows the following:

The following information was included with the event: 

 

attachment

<<test file>>

message with subject "<<test file>>", located in SMTP

Scan: Auto-Protect

Rule: UFR - Malformed Files

 

The attachment "<<test file>>" was <<policy action taken>> for the following 

reason(s):

Scan Engine Error.  CSAPI DEC result: 0x29. The DEC scanner resultID 

attribute is not set or is an invalid ID. Engine Name: .

 

Cause

7zip file with 'LZMA2' algorithm for compression is not supported by decomposer engine integrated on SMSMSE 7.5.1 or lower.

 

Resolution

Symantec is aware of this issue and will update this document when a solution becomes available. It may not be necessary to log a support case on this issue. Please subscribe to this article to be notified of any updates.

Workaround:

Hotfix has been released to resolve the isssue. SMSMSE 7.5.1 is required in order to install the hotfix.

Installation steps for the hotfix are included in the readme file which is embedded in the attached zip file. Password to extract the file is symc.

 

Applies To

SMSMSE 7.5.1