locked
Forefront blocks non-virus files

    Question

  • I found that at some unknown occassions, Forefront blocks files which I am 200% sure are not affected and hence I am unable to upload them to my SharePoint site. This doesn't happen all the time. but happens once in 3-4 days. The message appears as below.

    "<filename>"contains the following virus: ""

    here the virus name is always EMPTY.

    Any thoughts ?

    Thanks,

    Babu

     

     

     

    Friday, March 23, 2007 5:40 PM

All replies

  • We get the same behavior.  Any help is appreciated.
    Tuesday, March 27, 2007 2:52 PM
  • Went to the Sharepoint Mgmt Console, Central Administration, Antivirus, Unchecked Scan Uploads, saved the configuration.

    Tested uploading OK.

    Went back to Sharepoint Mgmt Console, Central Administration, Antivirus, Checked Scan Uploads, saved the configuration.

    Tested Uploading OK.

    This may be a configuration refresh issue in Sharepoint/Forefront.

     

    Tuesday, March 27, 2007 3:43 PM
  • Thanks Simon.

     

    But I am getting this issue intermittently. I couldn't test this as I have uninstalled it from production. Anyway, I have a test version where I am running forefront with no issues. Only difference I found is the production is a 64 bit machine while the QA is a 32 bit machine. I assume there is not different setups of Forefront for this so used the same standard version.

     

    Do you have any thoughts ?

     

    Thanks,

    Babs

    Tuesday, March 27, 2007 10:53 PM
  • Hi Simon,

     

    This works. But after a day, I tried again and the same issue persists. It can again be avoided by saving the Sharepoint Mgmt console's Antivirus settings. Some how, this is being reproduce after 24 hours.

     

    Any thoughts ?

     

    Thanks,

    Babs

    Thursday, March 29, 2007 6:25 PM
  • Are you seeing event ID 26424 appearing in the event log?
    Friday, March 30, 2007 10:39 PM
  • Babu.

     

    If you would like to utilize PSS Security support for these concerns please contact us through the following website:

     

    http://support.microsoft.com/oas/default.aspx?LN=en-us&gprid=12303&x=10&y=8 

     

    Thank you

     

     

     

    Thomas Roughley, PSS Security Escalation Manager (Forefront Server Security)
    Monday, April 02, 2007 6:29 PM
  • Babu,

     

    If you would like to contact PSS Security Support to help with this issue you can utilize the following information to contact us:

     

     

    http://support.microsoft.com/oas/default.aspx?LN=en-us&gprid=12303&x=16&y=8 

     

    Thank you

     

    Thomas Roughley, PSS Security Escalation Manager (Forefront Server Security)  Microsoft Corporation

    Monday, April 02, 2007 7:00 PM
  •  

     Microsoft is currently addressing a SharePoint issue that may culminate in the specific Forefront behavior you have described. At this point there is not an official hotfix but, in the mean time, our Forefront support staff may be able provide "work-around" fixes, after analyzing the specific issue on a case by case basis. These work-around fixes should be incorporated into an official hotfix by mid May. However, this is NOT an offical ETA for a hotfix release.

     

    Please contact MS PSS through our typical channels. If the issue is remedied via a "work around" fix provided by PSS, your account will not be charged for the incident if you are either a professional or premier customer.

     

    Additional support contact information can be found at the following link.

     

    http://support.microsoft.com/oas/default.aspx?LN=en-us&gprid=12303&x=16&y=8

     

     

    Robert M

    MS Support

    Monday, April 02, 2007 8:11 PM
  • Thanks Tom,

     

    I have already contacted MS support and seems like this is an issue with Forefront. How ever, this happens only intermittently and doesn't happen on stand alone machines. I have given some work arounds but they won't really work with our security team.

     

    Work around is

    Set a filter not to scan ASPX files

    restart Forefront

    Run a manual scan.

     

    I have tested this and seems like it is working fine. But I may have to wait for 2 more days to ensure this doesn't happen again.

     

    Thanks,

    Babu

    Tuesday, April 03, 2007 5:54 PM
  • Thanks Rob.

    I have already contacted MS support and seems like this is an issue with Forefront.

     

    Work around is

    Set a filter not to scan ASPX files

    restart Forefront

    Run a manual scan.

     

    I have tested this and seems like it is working fine. But I may have to wait for 2 more days to ensure this doesn't happen again.

     

    Thank you for your reply,

    Babs

    Tuesday, April 03, 2007 5:56 PM
  • Hi Bob,

     

    I am seeing an event ID 26424 in our servers but two cases.

     

    Description is below

     FSCControllerTongue TiedharePoint Realtime scan exceeded the allowed scan time limit.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

     

    Windows SharePoint Services: The description for Event ID ( 26424 ) in Source ( Windows SharePoint Services 3 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: #960012: Finished loading antivirus scanner. Error -2147024890..

     

     

    Does this have anything to do with this issue ?

     

    Please let me know if you have more info here.

     

    Thanks,

    Babu

    Tuesday, April 03, 2007 6:00 PM
  • Thanks Tom.

     

    I have contacted MS Support and working with them to resolve it. Will update the forum once I get a valid fix.

     

    Thanks,

    Babu

    Tuesday, April 03, 2007 6:05 PM
  • Hi

     

    Could you tell me exactly how you set it up to not scan ASPX files please?

     

    I have the same issue with PDF files being blocked for a virus but not reporting a virus, when a specific virus scan reports it as clean.

     

    Every thing I've tried to exclude PDF files from being scanned has failed, and the file is still being blocked as an empty virus

     

    Thanks

    Justin

    Thursday, April 12, 2007 1:37 PM
  • I am also getting this error, however I am getting it all the time so am unable to use Forefront.

    Can you please post instructions on how to stop scanning of ASPX files as the filter I created isn't resolving this issue.

     

    Regards

    Dan

    Monday, July 02, 2007 12:09 AM
  • I have the exact same problem running the 64 bit version and look forward to a fix.
    Tuesday, July 03, 2007 9:34 AM
  • We're also getting this issue and I'd also be interested in how to stop scanning ASPX files?

     

    I don't suppose anyone could offer any help other than suggesting everyone ring PSS Security Support and pay MS a lot of $$ ?

     

    A workaround or a KB article number pointing to a patch available for free would be really great

     

    Mant thanks

     

    Peter Lawton

    Friday, July 20, 2007 7:36 AM
  • I am currently using Antigen for SharePoint and i am facing the same problem.  Eventhough i used the same work-around which was posted in here, it still blocks the file that i am trying to upload.

     

    Any ideas here guys?  Thanks!

     

    Wednesday, August 01, 2007 12:17 PM
  • Hi guys,

     

    Atlast it is working !!!

     

    I have installed new Forefront SP1. Then I need to copy and paste a new SVSAPI.dll provided by MS. Then I need to make a registry change for Forefront to work.

     

    Somebody asked about how to filter an ASPX file. It is by going to Forefront Management Console>> Filtering>> File and Add *.aspx and make action to detect only and enable it.

     

    Now my Forefront is working great and I don't think have much complaints about it.. but it was a long journey !!!

     

    Thanks,

    Babu

     

    Tuesday, August 14, 2007 8:02 PM
  • Sorry, I missed this question

    Instructions to stop scanning ASPX files

    open Forefront Admin console. Go to Filtering. Click on File. Add a new item as *.aspx select "Detect only". Make the filter enabled and click Save.

    Now try to add a new page. See Forefont showing it as a detected file filter.

     

    Thanks,

    Babs

     

    Wednesday, October 03, 2007 6:44 PM
  • Hello Everyone,

     

    There is a much easier way of correcting this issue.  This is something that can be resolved by getting the hotfix for KB936867 or KB938537 or later versions of this rollup hotfix from SharePoint.  Along with this afterwards, I would recommend going to Forefront for SharePoint SP1.  If this is not done in this order it will still be OK. 

     

    "<filename>"contains the following virus: ""

    Here the virus name is always EMPTY.

     

    Source: Windows SharePoint Server
    Type: Error
    User: N/A
    Date: date
    Time: time
    Computer: computer_name
    Category: General
    Event ID: 26424
    Description: The description for Event ID ( 26424 ) in Source ( Windows SharePoint Services 3 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE=flagto retrieve this description; see Help and Support for details. The following information is part of the event: #960012: Finished loading antivirus scanner. Error -2147024890

     

    If you would like the safest instructions for install these recommended hotfixes or Services packs, you can refer to KB941268.

     

    Best regards,

     

     

    • Proposed as answer by Imperfect IT Thursday, July 24, 2008 5:06 PM
    Friday, October 05, 2007 8:31 PM
  • I had the following error as well:

    Event Type: Error
    Event Source: AntigenService
    Event Category: Scan Error
    Event ID: 5066
    Date:  7/24/2008
    Time:  12:32:35 PM
    User:  N/A
    Computer: SP002
    Description:
    SharePoint Realtime scan exceeded the allowed scan time limit.

    It turned out the password for the account that logged on the AntigenSP2Service (set to manually start) had been changed and had not been updated in services. As soon as I updated the password, the service was able to start and I could upload files.

    Hope this helps.

    Jon
    Thursday, July 24, 2008 5:09 PM
  • This is an update to my last post for this issue.  It is now recommended at this point that all customers using Forefront for SharePoint to run Service Pack 2.  Licensed customers can download this from your Microsoft Volume Licensing Services site.  This is a full install, but if Forefront for SharePoint is already installed it will just apply the Service Pack portion only.  This will help to avoid most of the issues that have been on the forums for this product. 

    You would also make sure that your running at least Service Pack 1 for SharePoint as well to fulfill the prerequisites.

    Best regards,
    Loyld
    Tuesday, August 05, 2008 12:52 PM
  • We ran into the same problem twice.  The way I orginally fixed the issue was to execute some SQL commands to reset the VirusStatus field to 0.  That worked the first time but after the second time I looked for a better solution.  We originally had realtime scans turned on in Forefront and told it to block all suspect files.

    I since changed that to attempt to clean first and we haven't seen the issue in a few weeks.
    • Proposed as answer by danwilburben Monday, August 25, 2008 1:50 PM
    Monday, August 25, 2008 1:50 PM