Menu
▾
▴
#756 PopFile Corrupts attachments
I have recently noticed that certain attachments
(.jpg, .doc, .ppt) become corrupted when PopFile scans
them. I am using Eudora 6.2 and Windows XP SP2 with
PopFile 0.22.2, but it was happening with Eudora 6.1
and PopFile 0.21.2 also. I am running Symantec
AntiVirus Corporate Edition 8.1.0.825 with Scan Engine
4.2.0.7 and Virus Defs 1/24/2005 rev.8. It scans
messages after they have been through POPfile, and
often catches viruses in files named
popfile####=1.msg, along with the actual attachment.
The problem has been narrowed to POPFile. Having
POPFile on, the a particular attachment is corrupt,
turning it off, the attchment is fine.
I use POP3, and recently changed it to leave a copy of
the email on the mail.utexas.edu server for 2 days. This
is so when I notice a corruption, I can go to the IMAP
server and view the real attachment.
without going through PopFile, the file is listed as:
Delivered-To: brhall@mail.utexas.edu
X-Mailer: QUALCOMM Windows Eudora Version 6.2.0.14
Date: Mon, 24 Jan 2005 16:10:18 -0600
To: brhall@mail.utexas.edu
From: Bradley Hall <brhall@mail.utexas.edu>
Subject: parktest
this is a test
-Brad
Content-Type: image/jpeg; name="parkbench.JPG" x-
mac-type="4A504547"; x-mac-creator="4A565752"
Content-Disposition: attachment;
filename="parkbench.JPG"
and in my email, the picture shows up just fine. Then
this same file when it goes through PopFile:
Return-Path: <brhall@mail.utexas.edu>
Delivered-To: brhall@mail.utexas.edu
Received: (qmail 44418 invoked from network); 24 Jan
2005 22:07:58 -0000
Received: from hobbes.icmb.utexas.edu (HELO
HOBBES.mail.utexas.edu) (146.6.213.25)
by wb2.mail.utexas.edu with RC4-SHA encrypted SMTP;
24 Jan 2005 22:07:58 -0000
Message-Id:
<6.2.0.14.2.20050124160716.0439d400@127.0.0.1>
X-Mailer: QUALCOMM Windows Eudora Version 6.2.0.14
Date: Mon, 24 Jan 2005 16:07:41 -0600
To: brhall@mail.utexas.edu
From: Bradley Hall <brhall@mail.utexas.edu>
Subject: parktest
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="=====================_275619650==_"
--=====================_275619650==_
Content-Type: text/plain; charset="us-ascii";
format=flowed
this is a test
-Brad
--=====================_275619650==_
Content-Type: image/jpeg; name="parkbench.JPG"
x-mac-type="4A504547"; x-mac-creator="4A565752"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="parkbench.JPG"
/9j/4Qo7RXhpZgAASUkqAAgAAAAKAA4BAgAgAAAAhgAAA
A8BAgAFAAAApgAAABABAgAOAAAArAAA
ABIBAwABAAAAAQAAABoBBQABAAAAvAAAABsBBQABAAAA
xAAAACgBAwABAAAAAgAAADIBAgAUAAAA
zAAAABMCAwABAAAAAgAAAGmHBAABAAAA4AAAAGQCAA
AgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgAFNPTlkAAENZQkVSU0hPVAAAAAAAAABIAAAAA
QAAAEgAAAABAAAAMjAwNTowMToyNCAw
MDo1MzoxNwAWAJqCBQABAAAA7gEAAJ2CBQABAAAA9gEA
ACKIAwABAAAAAgAAACeIAwABAAAAZAAA
AACQBwAEAAAAMDIxMAOQAgAUAAAA/gEAAASQAgAUAAA
AEgIAAAGRBwAEAAAAAQIDAAKRBQABAAAA
JgIAAASSCgABAAAALgIAAAWSBQABAAAANgIAAAeSAwAB
AAAAAgAAAAiSAwABAAAAAAAAAAmSAwAB
AAAAAAAAAAqSBQABAAAAPgIAAACgBwAEAAAAMDEwMAG
gAwABAAAAAQAAAAKgBAABAAAAgAIAAAOg
BAABAAAA4AEAAAWgBAABAAAARgIAAACjBwABAAAAAwA
AAAGjBwABAAAAAQAAAAAAAAABAAAA1gEA
ADgAAAAKAAAAMjAwNTowMToyNCAwMDo1MzoxNwAyMD
A1OjAxOjI0IDAwOjUzOjE3AAIAAAABAAAA
AAAAAAoAAAACAAAAAQAAANIAAAAKAAAAAgABAAIABAA
AAFI5OAACAAcABAAAADAxMDAAAAAACgAD
AQMAAQAAAAYAAAAPAQIABQAAAOICAAAQAQIADgAAAOg
CAAASAQMAAQAAAAEAAAAaAQUAAQAAAPgC
------There are more jpeg encoding lines here------
--=====================_275619650==_--
Found in encoded data: <g i
`ĂŐŠjÔßČÜű´í§
Ć94Ňž˘ż6âgzĘš*űNyďBÜmk{(ĎÎyÍ> <t>
˙Ř˙á Exif SONY CYBERSHOT SONY CYBERSHOT ˙Ř˙Ű
Notice the new Content-Transfer-Encoding: base64.
There is nothing in the log file suggesting an error. At
the bottom of the single message view in PopFile UI, it
shows that it found something in the encoded data
(attahcment).
This problem only occurs on certain attachments but
can be recreated on those affected attachments.
In the case of the .jpg, the error I get through
Photoshop CS is:
Could not complete your request because a JPEG marker
segment lenght is too short (the file may be truncated
or incomplete).
In the case of the .doc file, Word opens the file, but I
get a bunch of random text that appears to be an ASCII
representation of the .doc encoding format. It is the
same text that the POPFile UI scans through.
An example of the uncorrupted version of the JPG that is causing problems