a user is trying to receive an email through our exchange 2007 system above the size limit and it gets stopped as it should. They then try to receive the email in a compressed form which is below the size limit and it gets stopped with the error "FILE QUARANTINED The original contents of this file have been replaced with this message because of its characteristics. File name: 'sqldebug.zip' Virus name: 'Large uncompressed size' " So Forefront knows the size of the original file and stops it because of that. Sneaky. Anyone know of a way round this? Any help would be appreciated.

If its a one time thing, deliver the message out of quarantine, but whats interesting to me is that forefront thinks its a virus; was it compressed multiple times?

No it was not compressed multiple times. It seems to be more than a one off and I too am surprised that forefront thinks its a virus. Thanks