I run Security Center 9.15 on a Vista machine with Outlook 2007. All systems are up to date.
Outlook has 2 email accounts: 1 account from my own domain (default) with an unencrypted POP server and 1 Gmail account that uses an SSL POP server.
For some emails I receive to my default account in Outlook, PowerPoint attachments may be corrupted from the get go. When trying to open the file, I get an error message "PowerPoint can't read the outline from [file name]. No text converter is attached for this file type".
If I try to open the same attachment from the webmail access of my default account (i.e., not using Outlook), I can open the file without any problem.
If the same attachment is sent by the sender to my Gmail account, I can open the file either through Outlook (POP access) or through Gmail's site without any problem.
Now, if I forward the attachment from Gmail to my default account and try to open it through Outlook, I get the error message. But if I repeat this and disable Email Virus Protection prior to downloading the message in Outlook, then I can open the attachment without any problem.
Based on these various tests, I am reaching the conclusion that McAfee is corrupting some PPT attachments when scanning emails received in Outlook 2007 from an unencrypted POP server. I have also noted that the corrupted attachments are 4 to 5 KB smaller than the uncorrupted ones.
I should have added this assuming VirusScan has stripped something...
You'll have to disable VirusScan for a short time & reinstate that file in order to forward it to McAfee's Avert Labs for analysis. If it's in Quarantine then you can restore it by opening Security Center, click Advanced Menu (bottom left), click Restore at left. The right-hand side contains the file, hopefully.
Double-click the taskbar icon to open Security Center Click Advanced Menu (bottom left) Click Configure (left) Click Computer & Files (top left) You can disable VirusScan in the right-hand module and tell it for how long.
Then click the Restore button (left & assuming it was quarantined) & restore the item.
You can then forward it zipped to Avert. Guideline as follows for email submission.
Email file to: [EMAIL="firstname.lastname@example.org"]email@example.com When submitting samples via E-mail all samples must be packaged in a .ZIP file. When creating this .ZIP file, it is important to understand that the .ZIP can be no more than 3 megabytes in size and can contain no more than 30 files. Additionally, any .ZIP file created must be password-protected using the password "infected" (minus the ""). Failure to follow these guidelines will cause your submission to be rejected.
I looked at the link in your first post, but I am having a different issue/error message. I also tried to save the file first, but I received the same error message when I tried to open it with PowerPoint.
There's no item shown in the Email/IM log.
To recap my first post, if I receive a PPT attachment with the email protection running, it may be corrupted (seems to happen randomly). But if I receive the same PPT attachment with the email protection suspended, it will never be corrupted.