User was not able to open one particular word document (*.docx) unless NetAPP is disabled

Products

• Protection Engine for NAS

Issue/Introduction

A user was unable to open a specific Word document. When making the attempt to open the docx file the following error box would pop up (or something similar to it).

Sorry, we couldn't open "\\serverName\path\<fileName.docx>"

It was found that if the NetAPP service was disabled (vserver vscan disable) that the user could open the file.

Environment

Release : 8.2.2

 

Cause

NetAPP is actually not a Broadcom software program and therefore not supported by Broadcom--however it does interact with Symantec Protection Engine (SPE).  In this case, as the user was attempting to open the file from a path that was monitored by the program--NetAPP was passing the file to the SPE server to be scanned.  SPE was returning an error relating to the file.

For troubleshooting the problem a copy of the file was evaluated against the SPE scan engine by doing the following: (or if not interested in learning how these problems are boiled down jump to the end of this section for the root cause)

1. The file that could not be opened was copied to C:\Temp on the SPE server
2. A command prompt was opened and pointed to "C:\Program Files\Symantec\Scan Engine\CmdLineScanner\C>"
3. The following command was run > Example:    ssecls.exe "c:\temp\WordFileName.docx"
4. An error was thrown:  

The next step is to convert the current SPE log file to a *.csv format because the raw logs don't make a lot of sense:A search of the current log files under ".\Program Files\Symantec\Scan Engine\log"

1. Change the command prompt pointer to "C:\Program Files\Symantec\Scan Engine"
2. Run the following command:  LogConverter.exe -c .\log\SSE20220713.log > C:\Temp\SSE20220713.csv   { Note: The file name will always be "SSE" followed by Current year+Current Month+Current Day". If he file being converted is from another day pass in the file with that date in the name.}
3. Open the converted .csv file in the target folder (in this  case C:\Temp) and search for the file name that was previously evaluated. In this case the following entry was found (looks better when opened in Excel).
4. Wed Jul 13 23:26:46 Mountain Standard Time 2022,Scan Error,Error,no_path,WordFileName.docx,,,,,,,,,,,,,0.090,0.091,,,,,,,,,,,,Failed with scan error hex code 0x80800201,,,Decomposer,28,,,,,127.0.0.1,,,,10.255.1.187,1344,204790,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1657780006204,Smaug,,1268,,

The main focus was:  ,Failed with scan error hex code 0x80800201,,,Decomposer,28,,,,

Looking up Decomposer 28 it indicates a problem with a corrupt or empty container file.

In this case the file, when opened outside of the constraints of NetAPP-- had an embedded *.pdf file at the end of it. If the user attempted to open that file from within the document  the following error (or something similar) was thrown:

 

Resolution

The embedded PDF or other container file within the document was corrupted and or could not be opened.  And since the Scan Engine could not open it to determine its integrity the error was thrown and the entire process returned a failure. NetAPP did what it is supposed to do: Lock the file from being opened.