6 Replies Latest reply on Sep 21, 2009 8:26 AM by Peter M

    McAfee email protection corrupts attachments?

      I run Security Center 9.15 on a Vista machine with Outlook 2007. All systems are up to date.

      Outlook has 2 email accounts: 1 account from my own domain (default) with an unencrypted POP server and 1 Gmail account that uses an SSL POP server.

      For some emails I receive to my default account in Outlook, PowerPoint attachments may be corrupted from the get go. When trying to open the file, I get an error message "PowerPoint can't read the outline from [file name]. No text converter is attached for this file type".

      If I try to open the same attachment from the webmail access of my default account (i.e., not using Outlook), I can open the file without any problem.

      If the same attachment is sent by the sender to my Gmail account, I can open the file either through Outlook (POP access) or through Gmail's site without any problem.

      Now, if I forward the attachment from Gmail to my default account and try to open it through Outlook, I get the error message. But if I repeat this and disable Email Virus Protection prior to downloading the message in Outlook, then I can open the attachment without any problem.

      Based on these various tests, I am reaching the conclusion that McAfee is corrupting some PPT attachments when scanning emails received in Outlook 2007 from an unencrypted POP server. I have also noted that the corrupted attachments are 4 to 5 KB smaller than the uncorrupted ones.

      Can this be fixed?

      Thanks.
        • 1. RE: McAfee email protection corrupts attachments?
          Peter M
          Quite a long time back I had the same problem but using Windows Mail. .PPT/.PPS extensions would open if I saved them first, but not if I clicked on them in an email.

          I believe it was this article that solved the issue, but as I said it's a while back: http://www.winhelponline.com/articles/149/1/Unable-to-open-PPS-attachments-direc tly-from-Windows-Mail-in-Windows-Vista.html

          I don't think VirusScan is stripping anything, I think this is a Windows issue.

          If VirusScan is doing it them there should be a record in the Security Center

          Double-click the taskbar icon to open SC
          Click Advanced Options (bottom left)
          Click Reports & Logs (left)
          Click View Log (right)
          There should be a record in the Email & IM item on the left.
          • 2. RE: McAfee email protection corrupts attachments?
            Peter M
            I should have added this assuming VirusScan has stripped something...

            You'll have to disable VirusScan for a short time & reinstate that file in order to forward it to McAfee's Avert Labs for analysis. If it's in Quarantine then you can restore it by opening Security Center, click Advanced Menu (bottom left), click Restore at left. The right-hand side contains the file, hopefully.

            Double-click the taskbar icon to open Security Center
            Click Advanced Menu (bottom left)
            Click Configure (left)
            Click Computer & Files (top left)
            You can disable VirusScan in the right-hand module and tell it for how long.

            Then click the Restore button (left & assuming it was quarantined) & restore the item.

            You can then forward it zipped to Avert. Guideline as follows for email submission.

            Email file to: [EMAIL="virus_research@avertlabs.com"]virus_research@avertlabs.com
            When submitting samples via E-mail all samples must be packaged in a .ZIP file. When creating this .ZIP file, it is important to understand that the .ZIP can be no more than 3 megabytes in size and can contain no more than 30 files. Additionally, any .ZIP file created must be password-protected using the password "infected" (minus the ""). Failure to follow these guidelines will cause your submission to be rejected.
            • 3. Well
              Thanks, Peter.

              I looked at the link in your first post, but I am having a different issue/error message. I also tried to save the file first, but I received the same error message when I tried to open it with PowerPoint.

              There's no item shown in the Email/IM log.

              To recap my first post, if I receive a PPT attachment with the email protection running, it may be corrupted (seems to happen randomly). But if I receive the same PPT attachment with the email protection suspended, it will never be corrupted.

              Any other suggestion?

              Thanks.
              • 4. RE: Well
                Peter M
                Any records in the Reports & logs?
                • 5. RE: Well
                  None...
                  • 6. RE: Well
                    Peter M
                    The try Technical Support Chat and ask them to escalate the case if necessary. It certainly shouldn't be happening, unless of course the attachments are really infected.

                    I regularly get Powerpoint presentations in my email and have never had this issue, since the one I mentioned.