I opened a Trend Micro support case number for this problem. Even if Trend Micro released the Hot Fix, this post will remain on this page as reference for those who hit the same issue.
In case you are using Microsoft Office Web Apps 2013 & SharePoint 2013 and your farm is configured to use Trend Micro PortalProtect for Microsoft SharePoint as antivirus solution, it is possible to receive one of these two error messages whenever you try to add attachments to your OneNote files.
”Changes can’t be saved because there might be a virus in this section. Please copy your changes to a clean section and delete the original file.”
“OneNote cannot sync this section because it has a virus. Talk to your administrator to resolve the issue. (Error code: 0xE0000B9D)”
How can you reproduce the problem?
- When you are opening an OneNote file in the browser using OneNote Web App, whenever you try to insert pictures into your notes you will receive “Changes can’t be saved because there might be a virus in this section. Please copy your changes to a clean section and delete the original file.”.
- If you try to sync the OneNote to SharePoint using Microsoft Office OneNote 2013 (PC version) the sync fails only for those sections of OneNote where you have attachments. The error message will be “OneNote cannot sync this section because it has a virus. Talk to your administrator to resolve the issue. (Error code: 0xE0000B9D)”
The SharePoint logs are clear as possible: “Failed to scan file /sites/XXX/SiteAssets/My Notebook/Untitled Section.one due to scanner crashed.”.
If from SharePoint Central Administration we deactivate the Antivirus solution (basically not use Trend Micro PortalProtect for Microsoft SharePoint), the error message will not be shown in the page and the insert picture functionality will work again in OneNote Web App.
Unfortunately changing the Trend Micro PortalProtect settings (like deactivating real-time security risk scan) does not help. Activating Trend Support/System Debugger will not help either (you will not find any entries to demystify this issue).
Until now the only way I found to get rid of this issue was to disable / deactivate the antivirus engine from Central Administration.
I will update this entry based on the response I will have from Trend Micro support.
Update
(@Vladimir Maricic thank you for telling me about the hot fix – it simplified the support call with Trend Micro.)
TrendMicro released a Hot Fix for this problem. As far as I know this hotfix refers only for the PortalProtect 2.1R2 version (installation package for SharePoint 2013).
The Hot Fix is not available directly on the TrendMicro site. You need to contact the support and ask them to send it to you, but I am also make it available here (pp_21_r2_win_en_hfb4094 as I received it from the TrendMicro support). It is password protected – password: novirus
Please schedule the installation carefully. The Hot Fix is automatically restarting the SharePoint services, IIS server and Trend Micro PortalProtect windows services.
