ForeFront for Exchange 2007 SP3 RU4


  • Hi I am hoping someone can help me.

    We have ForeFront on one of our Hubs. We had an issue with Kaspersky engine which we resolved which blocked all inbound email and quaranteend them.

    The quaranteen log shows the incident as "EngineError".

    We also see the file as "winmail.dat->182597C2-E2ED-4A11-A2EC-74B5A4E9EAB1[23].png "

    My question is "Is there a way to deliver the email to the recipient in its original format"?

    I have tried but the end user gets .dat attachment, each mail is sent in 3 seperate parts.

    Settings are as follows:

    Engine error Action: Delete

    Transport Timeout Action: Delete

    Please help I have around 300 emails to redeliver to the recipient.


    Tuesday, October 09, 2012 10:15 AM


  • Hi

    Thank you for the post.

    As far as I know, this is normal behavior. Forefront Security converts a part of the original message into a Winmail.dat file. Then, as part of the transport scanning, Forefront Security scans the Winmail.dat file as a container file. If the original message in the Winmail.dat file contains a virus match or a filter match, Forefront Security replaces the infected component by using the deletion text.


    Nick Gu - MSFT

    Thursday, October 11, 2012 8:02 AM