Sign in
Microsoft.com
 
Forefront Server Security TechCenter
 
 
 
Forefront Server Security TechCenter > Forefront Server Security Forums > Forefront Security for Exchange Server > Winmail.dat and Exceedinglyinfected
Ask a questionAsk a question
Search Forums:
 

AnswerWinmail.dat and Exceedinglyinfected

  • Monday, November 02, 2009 5:24 PMTedF1 Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Using Forefront antivirus for Exchange 2007 and have received alert that Forefront detected virus exceedinglyinfected in file winmail.dat.  I don't find explanation of this in the documentation.  Any clue's?

    Thanks,
    Ted
     

Answers

  • Tuesday, November 03, 2009 4:50 AMNick Gu - MSFTMSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    0
    Sign In to Vote

    Hi,

     

    Thank you for your post.

     

    Before going any further, I want to know when does this issue occur? By default, Transport Scan Job scans Winmail.dat files for viruses. Exchange uses Winmail.dat files to send them between servers to facilitate replication. If Forefront Security for Exchange Server modifies any of these Winmail.dat files, the public folder replication process will fail. To avoid this from happening, you can set a new DWORD registry key named DoNotScanIPMReplicationMessages to 1, and the Transport Scan Job will not scan IPM replication messages.

     

    Meanwhile, you may refer to this article: http://support.microsoft.com/kb/906002/en-us

     

    Regards,

     

    Regards,

    Nick Gu - MSFT
     

All Replies

  • Monday, November 02, 2009 6:05 PMcbas_ Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    You know, I had the same problem, but it was not very usual.justin some cases so I ignored it but just for the record, I had the same issue
    sharepoint novice
     
  • Tuesday, November 03, 2009 4:50 AMNick Gu - MSFTMSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    0
    Sign In to Vote

    Hi,

     

    Thank you for your post.

     

    Before going any further, I want to know when does this issue occur? By default, Transport Scan Job scans Winmail.dat files for viruses. Exchange uses Winmail.dat files to send them between servers to facilitate replication. If Forefront Security for Exchange Server modifies any of these Winmail.dat files, the public folder replication process will fail. To avoid this from happening, you can set a new DWORD registry key named DoNotScanIPMReplicationMessages to 1, and the Transport Scan Job will not scan IPM replication messages.

     

    Meanwhile, you may refer to this article: http://support.microsoft.com/kb/906002/en-us

     

    Regards,

     

    Regards,

    Nick Gu - MSFT