OK, here is one I do not understand. This has happened at least 6 times that I
know of in the last 2 days. An email was received and processed by Declude. It
contained an attachment winmail.dat. BUT the sender had attached an XLSX file.
After talking to the intended recipient (who also talked to the sender) the
sender has stated that when he attached the XLSX file to the email, the file
appeared as an EXCEL ICON in the body of the email not where you would normally
see it under the subject line. This is in Outlook. The version he is using is
Outlook 2013. (15.0) What caught the attachment was ESET AV had a result code
of 10 which is "some files could not be scanned (may be threats)" which I then
treat as infected.
Here is the attachment info from the actual email as seen by Declude:
------=_NextPart_000_0082_01D0DC02.ECC7B260
Content-Type: application/ms-tnef;
name="winmail.dat"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="winmail.dat"
And from the headers:
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0082_01D0DC02.ECC7B260"
X-Priority: 1 (Highest)
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook 15.0
So how is it that Outlook is (correctly) interpreting the winmail.dat as an
XLSX file?
John T
eServices For You
#############################################################
This message is sent to you because you are subscribed to
the mailing list <community@mailsbestfriend.com>.
To unsubscribe, E-mail to: <community-...@mailsbestfriend.com>
To switch to the DIGEST mode, E-mail to <community-dig...@mailsbestfriend.com>
To switch to the INDEX mode, E-mail to <community-in...@mailsbestfriend.com>
Send administrative queries to <community-requ...@mailsbestfriend.com>
