locked
FCS deletes Offices files on opening? RRS feed

  • Question

  • Hi,

    today we found out that sometimes Office docx files are deleted on opening. It does not matter if they are stored locally or on a server share. When the user opens the file a .temp file is created and the original file is deleted. If the user closes the document without making changes, there is no warning that the file does not exist any more. If the user makes changes and tries to safe the file he is asked for filename and location.

    This does not happen always but it is reproducible. We are not even sure that FCS causes this serious problem, we are just evaluating possibilities. Has anybody ever heard of a behaviour like this?

    The configuration is: Windows 7 client, FCS and filter pack installed.

    Regards,
    Dagmar
    Thursday, November 5, 2009 9:55 PM

Answers

  • Hi,

     

    Thank you for your update.

     

    I am sorry for not telling you clearly. I mentioned we can “adjust real time AV”, that is we may do some file exclusions(*.docx) from malware scans and then we can make sure whether FCS causes this problem.

     

    Regards,


    Nick Gu - MSFT
    • Marked as answer by Nick Gu - MSFT Friday, November 13, 2009 7:28 AM
    Monday, November 9, 2009 10:41 AM

All replies

  • Hi,

     

    Thank you for the post.

     

    According to my research, Most MS Office files will create temp files when saving. Some antivirus software was latching onto these temp files and locking access from the parent application. We may adjust real time AV scan settings and see if it works. A simplified view of the scheme used to save an edited file as below:

    1.Create temp file
    2.Write temp file
    3.Delete original file
    4.Move temp to target name

     

    Regards,


    Nick Gu - MSFT
    • Proposed as answer by Nick Gu - MSFT Friday, November 13, 2009 7:28 AM
    Friday, November 6, 2009 2:45 AM
  • Hi,

    thank you for answering so quickly.

    I am afraid I did not get you at all. What exactly do you mean with "we may adjust real time AV scan settings and see if it works"? What would you suggest to do?

    Kind regards,
    Dagmar
    Friday, November 6, 2009 11:21 AM
  • Hi,

     

    Thank you for your update.

     

    I am sorry for not telling you clearly. I mentioned we can “adjust real time AV”, that is we may do some file exclusions(*.docx) from malware scans and then we can make sure whether FCS causes this problem.

     

    Regards,


    Nick Gu - MSFT
    • Marked as answer by Nick Gu - MSFT Friday, November 13, 2009 7:28 AM
    Monday, November 9, 2009 10:41 AM
  • I have not heard of this happening... best bet would be to try to get a Process Monitor log of the issue occurring to see what is issuing the command to delete the files.

    http://live.sysinternals.com/procmon.exe
    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
    Tuesday, November 10, 2009 9:04 PM
  • Thank you for your help. We are still working on that issue trying to isolate the conditions under which it happens.

    Kind regards,
    Dagmar
    Monday, November 23, 2009 7:33 PM