tnef question

[Mark Nienberg]

In "MailScanner.conf", if I have

Use TNEF Contents = replace

does MailScanner log the fact that it replaced a winmail.dat with the individual 
attachments?  I'm trying to troubleshoot a problem with attachments in messages we 
receive from an Outlook/Exchange user.  How can I tell if the original message had a 
winmail.dat or if it always had separate attachments?

The problem is that although the recipient can open and save the attachments, the 
attachments disappear if the recipient forwards the message.

# MailScanner -v
Running on
Linux tesla.tippingmar.com 2.6.17-1.2139_FC5 #1 Fri Jun 23 12:40:16 EDT 2006 i686 
athlon i386 GNU/Linux
This is Fedora Core release 5 (Bordeaux)
This is Perl version 5.008008 (5.8.8)

This is MailScanner version 4.56.8

We use the external tnef decoder v 1.4.3

Here are the headers from a bad message.  Note the strange line concerning mail 
reader not understanding MIME.

Received: from ph-svr-smtp1.wrtdesign.com (ph-svr-smtp1.wrtdesign.com [68.167.103.171])
	by mail.tippingmar.com (8.13.7/8.13.7) with ESMTP id kAU00Dl2014806
	for <linda at here.com>; Wed, 29 Nov 2006 16:00:17 -0800
Received: from sf-svr-exch1.wrtdesign.com ([192.168.106.25]) by 
ph-svr-smtp1.wrtdesign.com with Microsoft SMTPSVC(6.0.3790.1830);
  Wed, 29 Nov 2006 19:00:10 -0500
Received: by sf-svr-exch1.wrtdesign.com with Internet Mail Service (5.5.2653.19)
  id <VYD8H8NY>; Wed, 29 Nov 2006 16:00:08 -0800
From: Jennifer <someone at there.com>
To: "'us'" <linda at here.com>
Message-ID: <4AC4264EA86E3041A0909E6944D790CDB720 at sf-svr-exch1.wrtdesign.com>
X-Connecting-IP: 192.168.106.25
Subject: FW: DRAFT: Ameda Quals
Date: Wed, 29 Nov 2006 15:59:39 -0800
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: multipart/related;
  boundary="----_=_NextPart_000_01C71412.6E07A4B0";
  type="multipart/alternative"
X-OriginalArrivalTime: 30 Nov 2006 00:00:10.0566 (UTC) FILETIME=[80C43E60:01C71412]
X-tma-MailScanner: Found to be clean
X-tma-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=0.591,
	required 5.5, BAYES_00 -0.50, EXTRA_MPART_TYPE 1.09,
	HTML_MESSAGE 0.00, SPF_PASS -0.00)

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_000_01C71412.6E07A4B0
Content-Type: multipart/alternative;
  boundary="----_=_NextPart_001_01C71412.6E07A4B0"


------_=_NextPart_001_01C71412.6E07A4B0
Content-Type: text/plain

Mark