Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Split RAR file attachments are blocked by InterScan Messaging Security Suite (IMSS)

    • Updated:
    • 27 Feb 2014
    • Product/Version:
    • InterScan Messaging Security Suite 7.1 Linux
    • InterScan Messaging Security Suite 7.1 Windows
    • InterScan Messaging Security Suite 7.5 Windows
    • Platform:
    • Linux - Red Hat RHEL 5 32-bit
    • Windows 2003 Datacenter Server
    • Windows 2003 Enterprise Server
Summary
When receiving external emails with RAR-type attachments, and the RAR file is split into multiple parts, only the first part of the RAR file is scanned (and delivered) successfully.
Subsequent emails with the additional parts of the RAR file attachment meet the Other Scanning Exceptions, which is set to quarantine by default.
This setting is in the IMSS console under Policy > Scanning Exceptions > Other Scanning Exceptions.
Details
Public
This is a limitation of the Trend Micro Scan Engine where it cannot tell that two files are parts of a compressed file. It treats them as separate files, thus, the file is detected as a bad zip file. The files will result in the Scan Engine returning an error code in the log similar to the following:
2010/11/19 06:58:15 GMT-06:00 [10700:4128007872] An error occured while virus scan upon message 'A1D2E7F2-27F6-B0C0-4548-DC23C1FCAC9C'. Error: -82 '
BAD_ZIP_ERR'.
To bypass the '-82 BAD_ZIP_ERR' error code, edit the imss.ini file:
  1. Go to the /config folder, and then open the imss.ini file.
  2. Locate the [virus] section.
  3. Change the value of the "VSBIgnBadZipErr" parameter from "0" to "1".
    VSBIgnBadZipErr=1
  4. Save and close the imss.ini file.
  5. Restart the Trend Micro IMSS Scan Service.
Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1057264
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.