none
Forefront quarantines all messages 'Exceeded Internet Timeout'

    Question

  • Hi, I have forefront for exchange 2007 and it was working fine. Lately, we started to receive these messages:

    FILE QUARANTINED

     

    The original contents of this file have been replaced with this message because of its characteristics.

    File name: 'Body of Message'

    Virus name: 'Exceeded Internet Timeout'

    From almost every message we send, both outside and inside my organization. The parameters for the internet scanning are set to default (120000 for realtime/transport scan) so I cannot tell what's happening. We use the latest version (R2) and the default values for all the options. Can you please help me?

    Best regards


    Monday, November 02, 2009 4:26 PM

Answers

  • Hi,

    you know the time when an email was recieved and the error ocoured, so you only have to jump to the time in the log. You can check if an engine is responsible for the error by temporary disabling it.

    Greetings

    Christian
    Christian Groebner MVP Forefront
    Wednesday, November 04, 2009 4:52 PM

All replies

  • Hi,

    your files are quarantine because you have configured it this way. This message means that Forefront took longer than the configured value to scan the attachment. Look into the programlog.txt in the installation directory of FSE and check out if there is something interesting in it.

    I could imagine that a scan enginge is not working right, so the solution might be to check which engine this is in the programlog.txt and then temporary disable this one. If you can send emails now then stop the services and remove the files of the engine form the relating directory (make a backup of them first!). After you have removed them trigger an update for this enginge and everything should be good then.

    Greetings

    Christian
    Christian Groebner MVP Forefront
    Tuesday, November 03, 2009 7:54 AM
  • Hi, thanks for the reply. How can I check if an scaning engine is the responsable or it's having troubles? The log is about 5mb so it's pretty hard to ckeck out about some errors
    sharepoint novice
    Wednesday, November 04, 2009 4:38 PM
  • Hi,

    you know the time when an email was recieved and the error ocoured, so you only have to jump to the time in the log. You can check if an engine is responsible for the error by temporary disabling it.

    Greetings

    Christian
    Christian Groebner MVP Forefront
    Wednesday, November 04, 2009 4:52 PM
  • Hi

    This is due to Transport scan Time Out Setting.

    To get rid of this Go To General Options, and set "Transport Scan Timeout Action" to "Ignore".

    Thanks
    Prem Rana
    *******************************************
    MCP,MCSE MCSA Exchange 2003
    MCTS, MCITP Exchange 2007,2010
    ********************************************
    Sunday, April 08, 2012 9:04 PM
  • But doesn't that let a potential virus through?!
    Monday, July 22, 2013 4:35 AM