ESET AV 4.2.71 stripping text from HTML emails

ESET AV 4.2.71.2 and 4.2.76.0 stripping text from HTML emails - email body is blank

Hi,

I'm hoping for an update or solution on this issue.

Per https://www.wilderssecurity.com/showthread.php?t=301849, there has been an issue with selected clients receiving apparently blank emails.

Microsoft are also aware: http://support.microsoft.com/kb/2253312

I have a customer seeing this issue. Set-up as follows:

- Windows XP Pro SP3 + patches
- Outlook 2010 SP1 + patches
- Exchange Server 2010 - fully patched (part of SBS 2011 Std)
- ESET AV 4.2.71.2, definition 6863

When I send an HTML email (from my own machine, external to the organisation, also running Outlook 2010, received by Exchange 2010 via POP3 Connector) this client receives a blank email. Another user within the same organisation (but using Outlook 2007) sees the body text. Even if I send one email from my external machine to both recipients, one (2007) sees the email, one (2010) doesn't. Both recipients use the same Exchange 2010 server.

I have tried switching off scanning of email when OPENED and when READ. This didn't help. I tried colsing Outlook and sent another test email, then read it using OWA. Same result - blank body. Plain text emails (sent from my Outlook) arrive fine, all body text is visible.

Since Microsoft firmly suggest this is an ESET issue, is anyone able to offer a fix or workaround please?

UPDATE: Settings within problem client are:
Scan Received Email: ticked
Sent Email: ticked
Read Email: ticked

Scan plain text email body: unticked
Scan RTF email body: unticked
Convert email body to plain text: unticked

Repeat scan after update: ticked
Accept scan results from other modules: ticked

(I tried another test after unticking "Scan received email" and "Scan read email" but still the same result)

I have updated the client to v4.2.76.0 - still the same result after a reboot and sending a new test email.

Thanks,
Gary

 

Re: ESET AV 4.2.71.2 and 4.2.76.0 stripping text from HTML emails - email body is blank

Did you check the email source? I guess it's that it uses a non-standard html formatting and putting a signature at a wrong place rendered the html part unreadable.

 

Hi Marcos,

Thanks for the reply. No, the email source is fine - in the exact example quoted, it's my own laptop, I write to hundreds of different recipients; this is the only client that has the problem. In addition, the troublesome client has the same issue with many other emails it receives, all sent from different senders. The same senders don't have the issue with other recipients.

I also sent an email to the troublesome recipient, and a colleague running Outlook 2007; the colleague received it correctly.

Microsoft suggest (http://support.microsoft.com/kb/2253312) that it is an issue with NOD32 4.x and to contact ESET support. I have followed their steps regarding pipeline tracing, and indeed the source message contains the email text throughout the whole Exchange process (27 steps in total, 1 original email received, 16 routing steps, 10 SMTP receive steps).

Regards,
Gary

 

Another update - uninstalling ESET AV from the client machine fixes the problem. Except that isn't really a solution.

It seems many other people have had the same problem, going back many months. Are ESET able to replicate it?

Gary

 

That's expected. Also disabling tag messages that are appended to scanned email should have the same effect (they are disabled by default so you must have enabled them on purpose after installation).
I'd need to see the source html code of the email as well as the html code of the email with an ESET signature to find out what's wrong. Basically it should be a bad html formatting of the email.

 

I don't really understand how it can be expected - as I mentioned, I also sent an email to both the troublesome recipient, and a colleague running Outlook 2007; the colleague received it correctly. So two clients received the same email; one displayed it, one didn't. Their AV settings are identical (they were deployed using a cfg file, and are managed by a RAS, and password protected). So surely the AV should perform consistently? If it were expected, wouldn't it continue to blank out the email after uninstalling and reinstalling?

The ESET footer is set to only attach to emails that were infected; safe emails do not have anything appended.

There is no one single HTML footer causing the problem. The troublesome client is showing the issue with multiple emails from multiple senders; today alone it received about 15 blank emails from about 8 different senders.

My email signature was generated within Microsoft Word 2010; I'm happy to email you direct if you would like to check it. If I email myself, the message contents is readable (I use ESET AV 4.2.71.2 also) - this suggests that Outlook 2010 with ESET AV 4.2.71.2 can display an HTML email received containing the signature in my email.

I'm happy to supply what I can to help you diagnose this. Should I email a support email address with my signature?

Thanks,
Gary

 

For what it's worth, I am also seeing the same problem.

I also see e-mails that appear as corrupted XHTML.

Since I un-installed ESET NOD32, the problem seems to have gone away.

Would really appreciate some input from ESET - do they check these forums?

 

Could you upload some examples of such emails as msg/eml files somewhere and PM me the download link?

 

I have been having the same problem for months.
Un-installing NOD32 allows me to see email content.
I updated to version 4.2.76.0 and have the same issue.

Also, if I click "view source" under "other actions" I can see the email content.

Attached is the source for an email that displays as blank.
Hope this helps.

 

WHEW! I am glad to see that it is just not me having this issue! I have been fighting this for over a year now. I have talked to tech support about it to no avail. They had me try a few things, but nothing panned out, like making sure all emails were sent as plain text, and such, just to try. I have a school district with over 1000 PC's and 500 users. I took such a beating last year over Eset stripping words, characters, and sometimes whole lines/chucks out of the email, that I had to finally uninstall the program for every computer in our domain. Very frustrating in the fact that I cannot use a program I had just renewed for 3 more years! I am going to try redeploying the latest version as a trial to see if anything has changed, but it sound like it will not. I was hoping that Version 5 would be out for business by now, I mean SERIOUSLY....Home user version has been out and gotten version updates for a while now, why do the long term customers have to wait? I know... you will reply that you want to make sure it is a stable release, but history will show you that is not always the case. Hopefully Eset will get this issue resolved. I would love to provide more feedback, but the more I talk to my users about it, they more they act like I don't know what I am doing because I cannot get it fixed in over a year...

 

How bizarre. Sorry for dragging up an old thread, but we upgraded SBS2003 to SBS2011 last month, and SBS2011 comes with Exchange 2010. I was completely oblivious to this whole topic until today, when an Outlook 2003 user complained the emails were blank. So a google search yielded this and well, here I am! We've not had this issue at all on 115 PCs, and now we are getting it too :-( We don't append any signatures to any emails and we're running 4.2.76.0. No AV installed on the server.

Jim

 

Hi Jim,

I've just come across this problem on one of our customers machines (I've resolved it on numerous of my customers machines over the last 6+ months). The workaround for me was to not only untick the "append note" options, but also to change the drop down boxes from "To all scanned email" to "Never".

If you are required to use the tags, I can only recommend to contact ESET support; however I doubt they have a fix for this yet....they certainly haven't for the last 6+months.