Friday, August 15, 2008 7:40 PMWhich setting or registry key controls the attachment size that triggers the "Exceedingly compressed size" condition?
The only reference I could find was: http://www.forefront-blog.de/2007/04/17/Erweiterte+Einstellungen+F%c3%bcr+Die+Behandlung+Von+Archiven+Bei+Forefront+Security+For+Exchange.aspx
Monday, August 18, 2008 6:24 PMHi Shawn,
Long story short, you can manipulate this value by adding a hidden registry key.
The Exceedingly compressed size can be controlled by a registry key called MaxCompressedArchivedFileSize.
If any one object within the zip file has a COMPRESSED size of over the MaxCompressedArchivedFileSize (which is a default of approx
20MB) then Forefront will delete this file. The reason this was done was to prevent a denial of service attack where Antigen would be scanning an infinitely large file. The incident that you will see for this would be an "Exceedingly compressed size virus”.
If this is the reason why a message is getting caught you can do the following:
- In the registry go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\SharePoint or (Exchange) Server
- Add a DWORD Key of: MaxCompressedArchivedFileSize (equaling 40,000,000)
- Restart FSCController service
This is about 40 MB. This will allow the zip file itself to be about 40 MB before Forefront will take action on it.
Please let me know if this helps.
Monday, August 18, 2008 7:17 PMThanks for the information. This is very helpful.
Thursday, December 16, 2010 11:50 PMThank you for the instructions, this fixed the problem I was having too!
Wednesday, August 29, 2012 12:38 PM
I have problem with this registry setting: I set this long time ago. Current value is 52428800 (decimal). But now when I try to sent zipped file (compressed size is: 22880256), my forefront delete the file and a sender receive only text attachment with this content:
Microsoft Forefront Protection removed a file since it was found to be infected.
File name: "compressed_file.zip"
Malware name: "Exceedingly compressed size"
What is going on?
Can I disable it completely on outgoing emails?
Friday, August 31, 2012 7:23 AM
I found the solution.
In Forefront Protection 2010, the registry key shown above doesn't work.
To change compressed files size go to:
Forefront Protection 2010 for Exchange Server Administrator Console -> Policy Management -> Global Settings -> Advanced Options.
In Threshold Levels section you can change few files settings including Maximum compressed file size.