I opened a Trend Micro support case number for this problem. Even if Trend Micro released the Hot Fix, this post will remain on this page as reference for those who hit the same issue.
In case you are using Microsoft Office Web Apps 2013 & SharePoint 2013 and your farm is configured to use Trend Micro PortalProtect for Microsoft SharePoint as antivirus solution, it is possible to receive one of these two error messages whenever you try to add attachments to your OneNote files.
”Changes can’t be saved because there might be a virus in this section. Please copy your changes to a clean section and delete the original file.”
“OneNote cannot sync this section because it has a virus. Talk to your administrator to resolve the issue. (Error code: 0xE0000B9D)”
How can you reproduce the problem?
- When you are opening an OneNote file in the browser using OneNote Web App, whenever you try to insert pictures into your notes you will receive “Changes can’t be saved because there might be a virus in this section. Please copy your changes to a clean section and delete the original file.”.
- If you try to sync the OneNote to SharePoint using Microsoft Office OneNote 2013 (PC version) the sync fails only for those sections of OneNote where you have attachments. The error message will be “OneNote cannot sync this section because it has a virus. Talk to your administrator to resolve the issue. (Error code: 0xE0000B9D)”
The SharePoint logs are clear as possible: “Failed to scan file /sites/XXX/SiteAssets/My Notebook/Untitled Section.one due to scanner crashed.”.
If from SharePoint Central Administration we deactivate the Antivirus solution (basically not use Trend Micro PortalProtect for Microsoft SharePoint), the error message will not be shown in the page and the insert picture functionality will work again in OneNote Web App.
Unfortunately changing the Trend Micro PortalProtect settings (like deactivating real-time security risk scan) does not help. Activating Trend Support/System Debugger will not help either (you will not find any entries to demystify this issue).
Until now the only way I found to get rid of this issue was to disable / deactivate the antivirus engine from Central Administration. I will update this entry based on the response I will have from Trend Micro support.
(@Vladimir Maricic thank you for telling me about the hot fix – it simplified the support call with Trend Micro.)
TrendMicro released a Hot Fix for this problem. As far as I know this hotfix refers only for the PortalProtect 2.1R2 version (installation package for SharePoint 2013).
The Hot Fix is not available directly on the TrendMicro site. You need to contact the support and ask them to send it to you, but I am also make it available here (pp_21_r2_win_en_hfb4094 as I received it from the TrendMicro support). It is password protected – password: novirus
Please schedule the installation carefully. The Hot Fix is automatically restarting the SharePoint services, IIS server and Trend Micro PortalProtect windows services.
3 thoughts on “Trend Micro Portal Protect and OneNote sync issues”
thank you for your blog post.
I also experienced the same issue and logged a support ticket with TrendMicro, and they advised me that there is a hotfix available for this issue – pp_21_R2_win_en_hfb4094.exe
Did you also receive this hotfix? You can update your blog post and let people know that a hotfix is available via TrendMicro support 🙂
@Vladimir, I haven’t received any kind of useful answer from Trend support. I will try it soon and see if indeed is fixing the problem. Thank you for your comment!
I received the file from TrendMicro support. Indeed is fixing the problem. I will update the post. Thank you @Vladimir.
I think you got someone skilled when you contacted the support.
In my case the support answered in three days interval of time (and they not even started to collect details about the problem). Very unhappy with the TrendMicro support.