The Windows Application Event Log shows the following error event:
Event ID 218
Source: Symantec Mail Security for Microsoft Exchange
The attachment "<file name>.ppt" located in message with subject "<message subject>", located in <location> has violated the following policy settings:
Rule: Unscannable File Rule
The following actions were taken on it:
The attachment "<file name>.ppt" was Quarantined for the following reason(s):
Scan Engine Error. CSAPI DEC result: 0x11. Decomposer failed to open the container. at location PowerPoint Document
Some Powerpoint files cause the decomposer to trigger a boolean variable value which is handled improperly.
This issue is resolved in SMSMSE 6.5.6. Upgrade to 6.5.6 to fix this problem. If you are unable to upgrade at this time, you can apply the hotfix listed in the 'Workaround' section of this document.
Apply this hotfix.
1. Exit Symantec Mail Security console if it is open. 2. Stop the following services:
Symantec Mail Security for Microsoft Exchange Symantec Mail Security Utility Service
Click Start -> Run then type services.msc.
3. Rename the following file by appending a .old to the filename: