Odd atachment blocking issue

[Richard Coombe]

Hi,

Got an issue whereby if Sender1 sends a mail with attachment to Recipient1 the attachment is blocked, with the message:

This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "winmail.dat"
was believed to be infected by a virus and has been replaced by this warning
message.

If you wish to receive a copy of the *infected* attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Thu Jul 19 09:50:02 2012 the virus scanner said:
   Could not parse Outlook Rich Text attachment

Note to Help Desk: Look on the Taff () MailScanner in /var/spool/MailScanner/quarantine/20120719 (message AC4EA81B55.A3BA3).

But the message is CCed to Recipient2 and the attachment gets through. This behaviour is consistent when Sender1 sends emails to Recipient1 and then forwards the failed message or CCs to Recipient2.

The blocked attachment in is showing up as MIME Type: application/ms-tnef but on the CC'd the email it's MIME Type: application/vnd.ms-excel

Any thoughts on where to start looking for problems? I can sort of see what's happening but I can't figure out why the behaviour is different from one recipient to the next.

Mailscanner - 4.74.16 (yeah yeah, I know, but I'm using Ubuntu packages)
Postfix - 2.8.5-2~build0.10.04
TNEF - 1.4.9

Cheers,
Richard

IT Manager

Cyfeiriad       Address Alexandra House
307-315 Cowbridge Road East
Cardiff
CF5 1JD
Ffon    Phone   02920259182
07966807318
Ffacs   Fax     02920259199
Safle We        Web     [http://www.taffhousing.co.uk/sites/default/files/taff/twitter.jpg] <http://www.twitter.com/taffhousing>   [http://www.taffhousing.co.uk/sites/default/files/taff/fb.gif] <www.facebook.com/taffhousing>   [http://www.taffhousing.co.uk/sites/default/files/taff/www.gif] <www.taffhousing.co.uk>

[http://www.taffhousing.co.uk/sites/default/files/taff/wag.gif]    [http://www.taffhousing.co.uk/sites/default/files/taff/pad.gif]   [http://www.taffhousing.co.uk/sites/default/files/taff/sw.gif]   [http://www.taffhousing.co.uk/sites/default/files/taff/iipg.gif]
[http://www.taffhousing.co.uk/sites/default/files/taff/gptw11.gif]  [http://www.taffhousing.co.uk/sites/default/files/taff/gptw.gif]   [http://www.taffhousing.co.uk/sites/default/files/taff/gd.gif]   [http://www.taffhousing.co.uk/sites/default/files/taff/iipg_w.gif]
MEDDYLIWCH CYN I CHI ARGRAFFU! - THINK BEFORE YOU PRINT!


________________________________
This message is private and confidential. If you have received this message in error, please notify us and remove it from your system.
Please consider the environment before printing this email.

Any views or other information in this message which do not relate to our business are not authorised by us, nor does this message form part of any contract unless so stated.

Taff Housing Association - www.taffhousing.co.uk - A Charitable Housing Association registered under the Industrial and Provident Societies Acts 1965 No. 21408R. Registered by The National Assembly for Wales No. L009. Registered address: Alexandra House, 307-315 Cowbridge Road East, Cardiff CF5 1JD. VAT Registration Number: 869 8405 65.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120726/83074e97/attachment.html