How to troubleshoot Decomposer Result ID 17 scan errors from Protection Engine

Products

• Scan Engine
• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

After scanning an archive file, Microsoft Office file, or other container file, Symantec Protection Engine (SPE) records a Decomposer Result ID 17 scan error pair in its logs. You seek to determine why, and if possible, scan the file again without error.

Cause

Decomposer / 17 - RESULT_OPEN_CONTAINER_FAILED Scan Engine identified the file as an archive or container file, but was not able to open the file as an archive. There are multiple possible underlying causes for this condition. - The archive was corrupted during transmission. - The archive was corrupted as a result of exhausting available space in the filesystem location or share where it was written. - The archive was not properly constructed by the application which created it. - Following the creation of the archive, another application altered the archive improperly. Note that in the case of each condition above, Scan Engine is acting by design when it is not able to open the file and when it logs a Decomposer Result ID 17 scan error.

Resolution

• Upgrade to the most recent version of Protection Engine. Re-scan the file with the same connector.
• Copy the file to the local filesystem where Protection Engine is installed. Set Protection Engine to ICAP protocol. Re-scan file with the ssecls command line scanner.
• If the file triggering the Decomposer Result ID 17 scan error is an Office document, or a classic archive file (.zip, .rar., .tar.gz, etc), you can scan individual internal components to find the component that causes Protection Engine to fail.