Hello Everyone

We are experiencing a strange problem. About 3 weeks ago, several users
started to complain that the attachments they were sending out (mostly PDF
files but it can be other types) were corrupt when the recipient got them. I
f
they sent the same email a second time, the attachments were fine (usually).
We have not been able to track down the culprit.

Our environment consists of an Exchange 2003 SP2 server, a virus scanning
mail gateway and finally a spam-filter that sits on the edge. The Spam filte
r
box is a W2K3 Sp2 box. The spam filter uses IIS SMTP.

We have patched the Exchange server with the 	patch referenced in KB937625,
but that did not work. We have been able to verify that the email messages
are NOT corrupt all the way through the process up untill IIS SMTP sends the
message out to the recipients email system. Of this we are positive. After i
t
leaves our gateway it seems to change the attachment size slightly.

This happens with multiple people, sending to multiple outside companies. It
does not always happen. it does not always happen to the same person. It doe
s
happen several times a day.

Is there anything different with the SMTP service in W2K3 SP2? Is there any
kind of bug that chews up attachments?

Any help on this one would be appreciated.

Thank You

[ Post a follow-up to this message ]

> Our environment consists of an Exchange 2003 SP2 server, a virus scanning
> mail gateway and finally a spam-filter that sits on the edge. The Spam
> filter
> box is a W2K3 Sp2 box. The spam filter uses IIS SMTP.

What spam filter?  Anything component that actually reads, and potentially
alters the message by design, is a lot more suspect than the "wrapper"
SMTP service.

> Is there anything different with the SMTP service in W2K3 SP2? Is there
> any kind of bug that chews up attachments?

Having passed several million messages through such servers, I'd say no.

--Sandy

[ Post a follow-up to this message ]

Thanks Sandy, but in this case it isn't the spam-filter. I have the logged
copies of the email AFTER it passes through the filter and before it is is
sent via IIS SMTP and they are perfect. the bite size is exact and the
attachments are still good. The problem occurs after Exchange\Virus\Spam
filtering.

We have sent several million messages this year as well without a problem
until Windows 2003 SP2.

"Sanford Whiteman" wrote:
 
>
> What spam filter?  Anything component that actually reads, and potentially
> alters the message by design, is a lot more suspect than the "wrapper"
> SMTP service.
> 
>
> Having passed several million messages through such servers, I'd say no.
>
> --Sandy
>

[ Post a follow-up to this message ]

> Thanks Sandy, but in this case it isn't the spam-filter.

Are you really not going to confess the spam filter's name?  That isn't
too helpful. 

A spam filter implemented as an IIS SMTP event sink can make changes to
message metadata that result in different outbound message properties.

You say you have copies of the messages after they pass through an event
sink-based spam filter but before they enter the outbound message stream.
Are you getting these from the \Drop folder?  Those are the only messages
that can be said to *have* exited the event sink chain, but *not* have
entered an outbound queue.  How do these compare to messages purposely
left in \Queue?

Or are you grabbing message bodies from the \Queue folder?  If so, have
you compared with messages sent to a local domain (on the IIS SMTP server
itself) to confirm that messages in \Drop are not corrupt?

If you are getting your message copies from any other step in the process
(such as being archived by the spam filter itself), this is not a
trustworthy source.  Just because software writes a clean copy to disk
doesn't mean that's the same copy that is handed back to IIS as a message
object.  I'm not saying that your spam filter is the problem... but you
must eliminate it more scientifically.

If you can confirm that, from a single origin message sent to one local
and one remote address, the body in Queue is different than the one in
Drop, that would point to a bug outside of your spam filter and within IIS
SMTP (though not a known one).  If the body in Queue and Drop are
identical, but with a packet sniffer you can see that the transmitted data
is different, that would point more to a a NIC, cabling, or other network
issue.

> We have sent several million messages this year as well without a problem
> until Windows 2003 SP2.

Yes, I'm talking about SP2 machines passing millions per *week*.

--Sandy

[ Post a follow-up to this message ]

This might be a different thing, but the symptoms are the same.  I've seen
this when PDF's are attached using an aspx page.  This is related to the
encoding type.

http://weblogs.asp.net/steveschofie...workaround.aspx

If you are sending from Outlook, then there is a virus / spam scanner
somewhere corrupting the files it up.

--

Best regards,

Steve Schofield
Windows Server MVP - IIS
http://weblogs.asp.net/steveschofield


"Tom Baker" <TomBaker@discussions.microsoft.com> wrote in message
news:AD567F7F-2126-49E9-9602-61BC402B934B@microsoft.com...
> Hello Everyone
>
> We are experiencing a strange problem. About 3 weeks ago, several users
> started to complain that the attachments they were sending out (mostly PDF
> files but it can be other types) were corrupt when the recipient got them.
> If
> they sent the same email a second time, the attachments were fine
> (usually).
> We have not been able to track down the culprit.
>
> Our environment consists of an Exchange 2003 SP2 server, a virus scanning
> mail gateway and finally a spam-filter that sits on the edge. The Spam
> filter
> box is a W2K3 Sp2 box. The spam filter uses IIS SMTP.
>
> We have patched the Exchange server with the patch referenced in KB937625,
> but that did not work. We have been able to verify that the email messages
> are NOT corrupt all the way through the process up untill IIS SMTP sends
> the
> message out to the recipients email system. Of this we are positive. After
> it
> leaves our gateway it seems to change the attachment size slightly.
>
> This happens with multiple people, sending to multiple outside companies.
> It
> does not always happen. it does not always happen to the same person. It
> does
> happen several times a day.
>
> Is there anything different with the SMTP service in W2K3 SP2? Is there
> any
> kind of bug that chews up attachments?
>
> Any help on this one would be appreciated.
>
> Thank You

[ Post a follow-up to this message ]