Protection Engine 7.x is detecting text based files as Malformed
search cancel

Protection Engine 7.x is detecting text based files as Malformed

book

Article ID: 164738

calendar_today

Updated On:

Products

Protection Engine for Cloud Services Protection for SharePoint Servers Protection Engine for NAS

Issue/Introduction

Symantec Protection Engine (SPE) is returned a malformed container violation on text files like .txt, eml or MSG

SPE log entry:

Mon Feb 20 22:56:04 Pacific Standard Time 2017, A container violation has been found, Event Severity Level = Warning, URL = X.X.X.X/folder/SOMERANDOMFILE.msg, File name = SOMERANDOMFILE.msg, File status = BLOCKED, Component name = SOMERANDOMFILE.msg/__substg1.0_300B0102, Component disposition = NOT REPAIRED, Container Violation = Malformed container (file not scanned), Client IP = X.X.X.X, Scan Duration (sec) = 0.078, Connect Duration (sec) = 0.094, Symantec Protection Engine IP address = X.X.X.X, Symantec Protection Engine Port number = 1344, Uptime (in seconds) = 241588

Cause


 

Resolution

In some cases this is a cosmetic error and can safely be ignored.  ..The following commands will configure the scanner to ignore this detection to complete the scan of the file:

SPE 7.5.3 or newer

  1. Open a command prompt
  2. Change directory to the SPE install folder (default location: C:\Program Files (x86)\Symantec\Scan Engine)
  3. Stop the Symantec Protection Engine service
  4. Execute: xmlmodifier.exe -s /filtering/Container/MalformedContainersHandling/IgnoreStructureMismatchMalformity/@value true filtering.xml
  5. Start Symantec Protection Engine service

SPE 7.8

  1. Open a command prompt
  2. Change directory to the SPE install folder (default location: C:\Program Files\Symantec\Scan Engine)
  3. Stop the Symantec Protection Engine service
  4. Execute: xmlmodifier.exe -s /filtering/Container/MalformedContainersHandling/IgnoreStructureMismatchMalformity/@value true filtering.xml
  5. Start Symantec Protection Engine service
Powered by Wolken Software