Problem winmail.dat and TNEF

Jeff Mills Jeff.Mills at
Tue Feb 21 21:01:20 GMT 2012

I had to change to the internal TNEF decoder to fix this problem. It broke for me after upgrading to the latest MailScanner.

Apologies about the top posting - our email signature sits itself on the top even if I post to the bottom :/

Jeff Mills

Sydney Technology Solutions Pty Ltd
Unit F10, 101 Rookwood Road
Yagoona, New South Wales 2199
Phone:   02 8212 4722
Email:    Jeff.Mills at
Web :

Living our values, achieving success

Sydney Technology Solutions' operating philosophy is based on honesty, enthusiasm, respect, ownership, excellence and service. These values guide the way we manage our business and the way we service yours.

P Please consider the environment before printing this email

Sydney Technology Solutions accepts no liability for the
content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

-----Original Message-----
From: mailscanner-bounces at [mailto:mailscanner-bounces at] On Behalf Of mul
Sent: Wednesday, 22 February 2012 3:20 AM
To: mailscanner at
Subject: Problem winmail.dat and TNEF


i Have Mailscanner 4.83.25 as gateway for my exchange 2010.

Some users receive bad mail with winmail.what is weird is that same email sent
from outside to multiple recipients, will be good for three users and the last
has winmail.dat.
I look in logs and i found this :

Feb 21 16:26:34 ssgmail11 postfix/cleanup[13326]: 45651223C32: hold: header
Received: from ( [])??by (Postfix) with ESMTP id 45651223C32??for
<aurelie.salan at>; Tue, 21 Feb 2012 16:26:34 +010 from[]; from=<prvs=039899099c=celia.quele at>
to=<aurelie.salan at> proto=ESMTP helo=<>
Feb 21 16:26:34 ssgmail11 postfix/cleanup[13326]: 45651223C32: message-
id=<B089CFA5035B0F46814980F392A758AA01048D at hcu88.dit.cb>
Feb 21 16:26:34 ssgmail11 postfix/smtpd[13325]: disconnect from[]
Feb 21 16:26:34 ssgmail11 MailScanner[13458]: New Batch: Scanning 1 messages,
38837 bytes
Feb 21 16:26:34 ssgmail11 MailScanner[13458]: Expanding TNEF archive
at /var/spool/MailScanner/incoming/13458/45651223C32.A18CA/winmail.dat
Feb 21 16:26:34 ssgmail11 MailScanner[13458]: Trying to unpack nwinmail.dat in
message 45651223C32.A18CA, could not create subdirectory
45651223C32.A18CA//tnefRDxo5W, failed to unpack TNEF message
Feb 21 16:26:34 ssgmail11 MailScanner[13458]: Corrupt TNEF winmail.dat that
cannot be analysed in message 45651223C32.A18CA
Feb 21 16:26:34 ssgmail11 MailScanner[13458]: Virus and Content Scanning:
Feb 21 16:26:37 ssgmail11 MailScanner[13458]: Saved entire message
to /var/spool/MailScanner/quarantine/20120221/45651223C32.A18CA

It is problem with my mailwatch ?
I found that others guys on forum had update TNEF.PM with the last version,
how to do that  ?

MailScanner mailing list
mailscanner at

Before posting, read

Support MailScanner development - buy the book off the website!

This email has been scanned for viruses and dangerous content by
Sydney Technology Solutions MailMaster Email Protection Services.

For more information please visit
:Scanned by MailMaster1:

More information about the MailScanner mailing list