Virus Scanners when they screw up MOSS

Link: http://support.microsoft.com/kb/928169

The following applies to MOSS 2007 as well. This error happened to me as well and made me crap in my pants for awhile as I was clueless as to what happened. After some time I was able to fix it.

[SYMPTOMS]

When you use Microsoft Office SharePoint Portal Server 2003 (this applies to 2007 as well) on a computer that has an antivirus scan engine installed, you may experience the following symptoms:

When you browse through the Default.aspx page, you receive one of the following error codes:

• HRESULT:0x80041050
• HRESULT:0x80041051
• HRESULT:0x80041052
• HRESULT:0x80041054

When you try to open a file from a SharePoint document library, you receive the following error message:

• http://ServerName/Sites/Site/FileName contains the following virus: The Antivirus Scanner scan engine is offline. Please try to contact the scan engine later or contact your administrator.

Additionally, you may find messages that are related to the antivirus scan engine in the Windows SharePoint Services log file. The messages resemble the following:

• 0 08/16 00:09:25 6196 #96000a: infected by "The Symantec AntiVirus Scan Engine is offline. Please try to contact the scan engine later or contact your administrator. " - DOMAIN\USER - /sites/somesite/some document.doc
• 0 08/16 00:09:25 6196 #96000a: infected by "The Symantec AntiVirus Scan Engine is offline. Please try to contact the scan engine later or contact your administrator. " - DOMAIN\USER - /sites/somesite/default.aspx

Note: The Windows SharePoint Services log file is located in the following folder: %WINDIR%\TEMP

[SOLUTION] (with my changes):

1. Use Query Analyzer to connect to the SharePoint content database.
2. Run the following query to list all the files that are affected:
   
   SELECT *
   FROM Docs
   WHERE (VirusStatus > 0) AND (VirusStatus IS NOT NULL)
   
   
3. Open your SQL Server Management Studio and go to the Content Database where the page giving you the error is located (WSS_Content database for example)
4. Create a new query and run:
   
   SELECT *
   FROM AllDocs
   WHERE (VirusStatus > 0) and (VirusStatus is not null)
   
   
5. If any records are displayed, these are the files that have been indicated by the Virus Scanner (ForeFront probably - Sigh... Microsoft, come on!) to be infected, thus it will not let you access the file. If you are certain that these files are Virus free (run a manual scan just in case) then run the following query:
   
   UPDATE AllDocs
   SET VirusStatus = null
   WHERE (VirusStatus > 0) and (VirusStatus is not null)
   
   
6. You may also want to remove the VirusInfo as well since it usually contains a message saying the file has been infected or something all those lines (it's not important to remove, but I like to restore everything back to original state), run:
   
   UPDATE AllDocs
   SET VirusInfo = null
   WHERE (VirusInfo is not null)
   
   
7. After this is done, you will be able to access the files again. You MAY have to reboot your MOSS server and SQL Server if it still does not work even though the status has been cleared.