none
Exceedingly compressed size alert

Answers

  • Hi Shawn,

    Long story short, you can manipulate this value by adding a hidden registry key.

    The Exceedingly compressed size can be controlled by a registry key called MaxCompressedArchivedFileSize.

    If any one object within the zip file has a COMPRESSED size of over the MaxCompressedArchivedFileSize (which is a default of approx
    20MB) then Forefront will delete this file. The reason this was done was to prevent a denial of service attack where Antigen would be scanning an infinitely large file. The incident that you will see for this would be an "Exceedingly compressed size virus”.

    If this is the reason why a message is getting caught you can do the following:

    • In the registry go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\SharePoint or (Exchange) Server
    • Add a DWORD Key of:  MaxCompressedArchivedFileSize (equaling 40,000,000)
    • Restart FSCController service

    This is about 40 MB. This will allow the zip file itself to be about 40 MB before Forefront will take action on it.

    Please let me know if this helps.

    Thanks
    Rob



    Rob M
    Monday, August 18, 2008 6:24 PM

All replies

  • Hi Shawn,

    Long story short, you can manipulate this value by adding a hidden registry key.

    The Exceedingly compressed size can be controlled by a registry key called MaxCompressedArchivedFileSize.

    If any one object within the zip file has a COMPRESSED size of over the MaxCompressedArchivedFileSize (which is a default of approx
    20MB) then Forefront will delete this file. The reason this was done was to prevent a denial of service attack where Antigen would be scanning an infinitely large file. The incident that you will see for this would be an "Exceedingly compressed size virus”.

    If this is the reason why a message is getting caught you can do the following:

    • In the registry go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\SharePoint or (Exchange) Server
    • Add a DWORD Key of:  MaxCompressedArchivedFileSize (equaling 40,000,000)
    • Restart FSCController service

    This is about 40 MB. This will allow the zip file itself to be about 40 MB before Forefront will take action on it.

    Please let me know if this helps.

    Thanks
    Rob



    Rob M
    Monday, August 18, 2008 6:24 PM
  • Thanks for the information. This is very helpful.
    Shawn
    Monday, August 18, 2008 7:17 PM
  • Thank you for the instructions, this fixed the problem I was having too!
    Thursday, December 16, 2010 11:50 PM
  • Hi,
    I have problem with this registry setting: I set this long time ago. Current value is 52428800 (decimal). But now when I try to sent zipped file (compressed size is: 22880256), my forefront delete the file and a sender receive only text attachment with this content:

    Microsoft Forefront Protection removed a file since it was found to be infected.
    File name: "compressed_file.zip"
    Malware name: "Exceedingly compressed size"

    What is going on?

    Can I disable it completely on outgoing emails?

    Wednesday, August 29, 2012 12:38 PM
  • I found the solution.

    In Forefront Protection 2010, the registry key shown above doesn't work.
    To change compressed files size go to:
    Forefront Protection 2010 for Exchange Server Administrator Console -> Policy Management -> Global Settings -> Advanced Options.
    In Threshold Levels section you can change few files settings including Maximum compressed file size.



    • Edited by kcerb Friday, August 31, 2012 7:26 AM
    • Proposed as answer by Daniel Ovadia Friday, February 15, 2013 9:17 AM
    Friday, August 31, 2012 7:23 AM