Email attachments change extensions and names. Why and why?

Question

System administration

Good afternoon.

There is a Win10Pro + MS Office 2016 computer. Messages with office attachments .doc .docx .xls .pdf .odf... arrive in Outlook... PART!!! of them (NOT ALL!) take the form

it was: "Evacuation plan 23I.doc"
became: "Pla%DAF%FGH%KDKDL%N .tmp or

.dat No. Actually... they didn't open.

I found a mailer check in Kaspersky and an error when checking all these attachments for size. Although they weigh 4 MB. There is also a tab "RENAMING OBJECTS OF SCAN", but these file extensions are not included there (those .js are included, etc. etc.)

If it runs Thunderbird on the same computer... then all the attachments are in perfect shape.As they should be.

The first file was received in this form on September 14th. After office update.

But similar problems do not google. What can be wrong?

Answer 1

Update KB4574727 was supposed to fix this problem, but for some reason it does not always help. He didn't help me either. Moreover, this is only for versions installed with C2R (ClickToRun)
In general, until MS releases a new patch that solves the problem, the scheme of actions is below.
This problem is observed in all versions except Version 2005 (build 12827.20470), so we roll back to it, disable office updates and wait for a normal patch.
1. Run command prompt as Administrator (cmd.exe)
2. Go to clicl2run setup
cd %programfiles%\Common Files\Microsoft Shared\ClickToRun
3. Rollback to build 12827.20470
officec2rclient.exe /update user updatetoversion=16.0.12827.20470
4. Disable office updates
Launch any office application (Word, Excel, Outlook...), then File -> Office Account -> Office Updates -> Disable Updates

Answer 2

Found mailer check in Kaspersky

hehe, go ahead

Answer 3

Open the letter in its original form (with headers and other things), look at the form in which the file name is written in it. There are many ways to encode filenames , and based on your screenshot in the comments, I suspect Outlook is showing it from the filename parameter of the Content-Disposition field .
Long names are encoded in Content-Disposition in multiple lines. For example, the file name "Simple file.txt" looks like this:

Content-Type: text/plain; charset=UTF-8;
 name="=?UTF-8?B?0J/RgNC+0YHRgtC+0Lkg0YTQsNC50LsudHh0?="
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename*0*=UTF-8''%D0%9F%D1%80%D0%BE%D1%81%D1%82%D0%BE%D0%B9%20%D1%84;
 filename*1*=%D0%B0%D0%B9%D0%BB%2E%74%78%74

Apparently, either due to an error in the message handler (using antivirus or filters on the server), or due to an error in Outlook, only the first line of the file is displayed correctly ( filename*0* , "Simple f" in my case ), and subsequent ones ( filename*1* and so on) are not decoded. Your screenshot also shows 9 correct first characters, which confirms my guess.

Answer 4

standard Windows problem with encodings :)
use adequate products, not microsoftware. especially if they all work.

Answer 5

It seems to me that the problem is not entirely in the office, or even not at all in it.
The problem is in Kaspersky, 90%.
We somehow often had such a problem that some attachments changed the file extension - such as docx to _docx. Empirically, we found out that this is if there are two or more dots before the file name extension, or there is something else before the dot, but not a letter or a visible symbol.
I don’t remember what and how they found out further, but it stuck in my memory that Kaspersky is paranoid about such things - since there are viruses that like to send attachments like “bill for 12/20/2018.docx [there are a lot of spaces].exe”, or with rar at the end, and in the text of the letter in plain text the password from the archive. As a result, the user is likely to open such a file, and the antivirus does not see its contents, because. the archive is encrypted.
In short, somehow a wave of such problems went away by itself, either when changing the version of Kaspersky, or not on the administration server, the admins configured something more adequately (I don’t have access there).
So, most likely, the paranoid Kaspersky suspects an attachment, for some reason cannot unpack / check it, and renames something in case of an error, but then it comes out somehow clumsily ...
Perhaps there is more than one problem, and outlook also has some kind of bug.

Answer 6

Perhaps there are exploits in the files that are designed for incorrect processing by either Outlook or Kaspersky.

Answer 7

Hello everyone, I have the same problem, I read the review and realized that I also have Kaspersky.
I went into its settings, mail antivirus settings and there in the advanced settings unchecked "connect extension for Microsoft Outlook". Well, while the problem did not recur, I hope it was in this.