Sharepoint Docs Reporting Virsuses

Occasionally a virus scanner running on Sharepoint will give false positives and mark the page/doc as such. In most cases, the trapping will be legitimate, but there are those occasions that the virus scanner has just made a mistake. Normally you could download the latest updated virus definitions and a rescan should reset the file, but if for some reason there is no updated virus definition yet how do you reverse the process? The answer requires a little massaging of the SQL database that the doc or page resides in.

Per http://support.microsoft.com/kb/928169:

The first thing you want to do is run a SQL query to find out of any pages or documents are marked with a non-null character. This can be done in Query Analyzer with the following script:

SELECT *
FROM AllDocs
WHERE (VirusStatus > 0) and (VirusStatus is not null)

This will give a report of all documents that are marked as being infected. To reset them, another script must be run in Query Analyzer:

UPDATE AllDocs
SET VirusStatus = null
WHERE (VirusStatus > 0) and (VirusStatus is not null)

Then, to remove any reference that the file was ever identified as a virus, you must reset the virusinfo field as well:

UPDATE AllDocs
SET VirusInfo = null
WHERE (VirusInfo is not null)

And that will get you back to how things were before everything occurred. Now, if you need to leave some files or pages marked as bad, you can alter the script to identify only those items you want to reset.

April 15, 2009 Tags: Microsoft Sharepoint SQL Posted in: Uncategorized