I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container
violation' in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that in Yahoo messages, the header as sent from
Yahoo ends:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end of
the message header and the beginning of the message body. The values
for the message id and boundary string will vary from message to
message.

After passing through the Bellsouth spam filtering, the header becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added, which
in itself is OK. But the blank line has gotten lost. Another curious
change is that a space has been added in the boundary string that was
after the message id after the =: and before the ending 5 digit number.
But that doesn't seem to bother Outlook Express. I don't know if that
would bother Outlook (I've had reports that Outlook users are having the
same problem. It's not confined to Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an EML
file (File, Save As), open in Notepad and insert the missing blank line
after the X-SOURCE-IP header, then save and double click the EML file to
open. It can be also dragged back to an OE folder to save and the
original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or
some software installed on the client's PCs. I suspect it's happening
on the mail server.

2) Why messages from Yahoo are affected but not others. It may be that
the headers are inserted after the message-id or it may be that the
other mail clients don't start the body with the boundary line, but have
some unimportant text there. For example, when Outlook Express sends a
message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers to
fix their buggy spam filter.

--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm

applause

Michael Santovec wrote:
I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container
violation' in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that in Yahoo messages, the header as sent from
Yahoo ends:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end of
the message header and the beginning of the message body. The values
for the message id and boundary string will vary from message to
message.

After passing through the Bellsouth spam filtering, the header becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added, which
in itself is OK. But the blank line has gotten lost. Another curious
change is that a space has been added in the boundary string that was
after the message id after the =: and before the ending 5 digit number.
But that doesn't seem to bother Outlook Express. I don't know if that
would bother Outlook (I've had reports that Outlook users are having the
same problem. It's not confined to Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an EML
file (File, Save As), open in Notepad and insert the missing blank line
after the X-SOURCE-IP header, then save and double click the EML file to
open. It can be also dragged back to an OE folder to save and the
original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or
some software installed on the client's PCs. I suspect it's happening
on the mail server.

2) Why messages from Yahoo are affected but not others. It may be that
the headers are inserted after the message-id or it may be that the
other mail clients don't start the body with the boundary line, but have
some unimportant text there. For example, when Outlook Express sends a
message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers to
fix their buggy spam filter.

Nice catch. I have an account with them, but don't use their email much and
never from the web.

steve

"Michael Santovec" wrote in message
...
I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container violation'
in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that in Yahoo messages, the header as sent from
Yahoo ends:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end of
the message header and the beginning of the message body. The values for
the message id and boundary string will vary from message to message.

After passing through the Bellsouth spam filtering, the header becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added, which
in itself is OK. But the blank line has gotten lost. Another curious
change is that a space has been added in the boundary string that was
after the message id after the =: and before the ending 5 digit number.
But that doesn't seem to bother Outlook Express. I don't know if that
would bother Outlook (I've had reports that Outlook users are having the
same problem. It's not confined to Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an EML
file (File, Save As), open in Notepad and insert the missing blank line
after the X-SOURCE-IP header, then save and double click the EML file to
open. It can be also dragged back to an OE folder to save and the
original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or some
software installed on the client's PCs. I suspect it's happening on the
mail server.

2) Why messages from Yahoo are affected but not others. It may be that the
headers are inserted after the message-id or it may be that the other mail
clients don't start the body with the boundary line, but have some
unimportant text there. For example, when Outlook Express sends a
message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers to
fix their buggy spam filter.

--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm

I've since heard from some BellSouth customers that BellSouth has
admitted to the problem and is working on it. We'll see how long it
takes to fix it.

Based on reports from some others, it seems that the colon in the Yahoo
boundary string is what's tripping up the Spam filter. It thinks the
boundary string is a header, even though it's in the body of the
message. That would also explain why the filter also inserted the space
after the colon since headers are of the format
xxxx: yyyy
It was trying to fix the "bad header" that wasn't really a header.

rant another example of anti-virus e-mail scanning and anti-spam
writers messing with things that they don't fully understand and making
them worse. /rant

--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm


"Steve Cochran" wrote in message
...
Nice catch. I have an account with them, but don't use their email
much and never from the web.

steve

"Michael Santovec" wrote in message
...
I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container
violation' in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that in Yahoo messages, the header as sent from
Yahoo ends:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end
of the message header and the beginning of the message body. The
values for the message id and boundary string will vary from message
to message.

After passing through the Bellsouth spam filtering, the header
becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added,
which in itself is OK. But the blank line has gotten lost. Another
curious change is that a space has been added in the boundary string
that was after the message id after the =: and before the ending 5
digit number. But that doesn't seem to bother Outlook Express. I
don't know if that would bother Outlook (I've had reports that
Outlook users are having the same problem. It's not confined to
Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an
EML file (File, Save As), open in Notepad and insert the missing
blank line after the X-SOURCE-IP header, then save and double click
the EML file to open. It can be also dragged back to an OE folder to
save and the original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or
some software installed on the client's PCs. I suspect it's
happening on the mail server.

2) Why messages from Yahoo are affected but not others. It may be
that the headers are inserted after the message-id or it may be that
the other mail clients don't start the body with the boundary line,
but have some unimportant text there. For example, when Outlook
Express sends a message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers
to fix their buggy spam filter.

--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm

"Michael Santovec" wrote in message
...
I've since heard from some BellSouth customers that BellSouth has admitted
to the problem and is working on it. We'll see how long it takes to fix
it.

Based on reports from some others, it seems that the colon in the Yahoo
boundary string is what's tripping up the Spam filter. It thinks the
boundary string is a header, even though it's in the body of the message.
That would also explain why the filter also inserted the space after the
colon since headers are of the format
xxxx: yyyy
It was trying to fix the "bad header" that wasn't really a header.

rant another example of anti-virus e-mail scanning and anti-spam writers
messing with things that they don't fully understand and making them
worse. /rant


Its even worse in Vista.

steve



--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm


"Steve Cochran" wrote in message
...
Nice catch. I have an account with them, but don't use their email much
and never from the web.

steve

"Michael Santovec" wrote in message
...
I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container
violation' in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that in Yahoo messages, the header as sent from
Yahoo ends:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end of
the message header and the beginning of the message body. The values
for the message id and boundary string will vary from message to
message.

After passing through the Bellsouth spam filtering, the header becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added, which
in itself is OK. But the blank line has gotten lost. Another curious
change is that a space has been added in the boundary string that was
after the message id after the =: and before the ending 5 digit number.
But that doesn't seem to bother Outlook Express. I don't know if that
would bother Outlook (I've had reports that Outlook users are having the
same problem. It's not confined to Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an EML
file (File, Save As), open in Notepad and insert the missing blank line
after the X-SOURCE-IP header, then save and double click the EML file to
open. It can be also dragged back to an OE folder to save and the
original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or
some software installed on the client's PCs. I suspect it's happening
on the mail server.

2) Why messages from Yahoo are affected but not others. It may be that
the headers are inserted after the message-id or it may be that the
other mail clients don't start the body with the boundary line, but have
some unimportant text there. For example, when Outlook Express sends a
message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers to
fix their buggy spam filter.

--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm

I'm having a similar problem with Outlook 2003 (and Bell South). I can
receive attachments in the BellSouth web mail, but not in Outlook. Any
thoughts and help would be greatly appreciated. This was not a problem until
about 1-2 weeks ago.

"Michael Santovec" wrote:

I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container
violation' in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that in Yahoo messages, the header as sent from
Yahoo ends:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end of
the message header and the beginning of the message body. The values
for the message id and boundary string will vary from message to
message.

After passing through the Bellsouth spam filtering, the header becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added, which
in itself is OK. But the blank line has gotten lost. Another curious
change is that a space has been added in the boundary string that was
after the message id after the =: and before the ending 5 digit number.
But that doesn't seem to bother Outlook Express. I don't know if that
would bother Outlook (I've had reports that Outlook users are having the
same problem. It's not confined to Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an EML
file (File, Save As), open in Notepad and insert the missing blank line
after the X-SOURCE-IP header, then save and double click the EML file to
open. It can be also dragged back to an OE folder to save and the
original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or
some software installed on the client's PCs. I suspect it's happening
on the mail server.

2) Why messages from Yahoo are affected but not others. It may be that
the headers are inserted after the message-id or it may be that the
other mail clients don't start the body with the boundary line, but have
some unimportant text there. For example, when Outlook Express sends a
message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers to
fix their buggy spam filter.

--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm

Based on messages that I've received from other Outlook users, the
attachment shows up in the message body as encoded text. In that case,
it is possible to use a 3rd party decoder to decode the attachment, but
it is a bit involved.

See the Decoding Mechanics section of
Decoding Internet Attachments - A Tutorial
http://pages.prodigy.net/michael_santovec/decode.htm

I don't know how much you have been following this. The problem is
caused by a bug in the BellSouth spam filter that corrupts messages from
Yahoo. According to some other BellSouth customers, BellSouth has
admitted that the problem is on their end and are working on a fix.


--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm


"Beermaker" wrote in message
...
I'm having a similar problem with Outlook 2003 (and Bell South). I
can
receive attachments in the BellSouth web mail, but not in Outlook.
Any
thoughts and help would be greatly appreciated. This was not a
problem until
about 1-2 weeks ago.

"Michael Santovec" wrote:

I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container
violation' in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that in Yahoo messages, the header as sent from
Yahoo ends:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end
of
the message header and the beginning of the message body. The values
for the message id and boundary string will vary from message to
message.

After passing through the Bellsouth spam filtering, the header
becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added,
which
in itself is OK. But the blank line has gotten lost. Another
curious
change is that a space has been added in the boundary string that was
after the message id after the =: and before the ending 5 digit
number.
But that doesn't seem to bother Outlook Express. I don't know if
that
would bother Outlook (I've had reports that Outlook users are having
the
same problem. It's not confined to Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an
EML
file (File, Save As), open in Notepad and insert the missing blank
line
after the X-SOURCE-IP header, then save and double click the EML file
to
open. It can be also dragged back to an OE folder to save and the
original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or
some software installed on the client's PCs. I suspect it's
happening
on the mail server.

2) Why messages from Yahoo are affected but not others. It may be
that
the headers are inserted after the message-id or it may be that the
other mail clients don't start the body with the boundary line, but
have
some unimportant text there. For example, when Outlook Express sends
a
message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers
to
fix their buggy spam filter.

--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm

On May 18, 7:21 pm, "Michael Santovec"
wrote:
Based on messages that I've received from other Outlook users, the
attachment shows up in the message body as encoded text. In that case,
it is possible to use a 3rd party decoder to decode the attachment, but
it is a bit involved.

See the Decoding Mechanics section of
Decoding Internet Attachments - A Tutorialhttp://pages.prodigy.net/michael_santovec/decode.htm

I don't know how much you have been following this. The problem is
caused by a bug in the BellSouth spam filter that corrupts messages fromYahoo. According to some other BellSouth customers, BellSouth has
admitted that the problem is on their end and are working on a fix.

--

Mike -http://pages.prodigy.net/michael_santovec/techhelp.htm

"Beermaker" wrote in message

...



I'm having a similar problem with Outlook 2003 (and Bell South). I
can
receive attachments in the BellSouth web mail, but not in Outlook.
Any
thoughts and help would be greatly appreciated. This was not a
problem until
about 1-2 weeks ago.

"Michael Santovec" wrote:

I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container
violation' in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that inYahoomessages, the header as sent from
Yahooends:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end
of
the message header and the beginning of the message body. The values
for the message id and boundary string will vary from message to
message.

After passing through the Bellsouth spam filtering, the header
becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added,
which
in itself is OK. But the blank line has gotten lost. Another
curious
change is that a space has been added in the boundary string that was
after the message id after the =: and before the ending 5 digit
number.
But that doesn't seem to bother Outlook Express. I don't know if
that
would bother Outlook (I've had reports that Outlook users are having
the
same problem. It's not confined to Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an
EML
file (File, Save As), open in Notepad and insert the missing blank
line
after the X-SOURCE-IP header, then save and double click the EML file
to
open. It can be also dragged back to an OE folder to save and the
original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or
some software installed on the client's PCs. I suspect it's
happening
on the mail server.

2) Why messages fromYahooare affected but not others. It may be
that
the headers are inserted after the message-id or it may be that the
other mail clients don't start the body with the boundary line, but
have
some unimportant text there. For example, when Outlook Express sends
a
message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers
to
fix their buggy spam filter.

--

Mike -http://pages.prodigy.net/michael_santovec/techhelp.htm- Hide quoted text -

- Show quoted text -

During my examination of this issue, I have found some additional
mangling of the Yahoo mail header.
The line previous to the End Of Header blank line, is also missing:

Content-Length: xxxx

FYI, The Message-ID: line is also added by Bellsouth.

As sent by Yahoo:
================================================== =======
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-1245986473-1179538270=:
14599"
Content-Transfer-Encoding: 8bit
Content-Length: 2200

--0-1245986473-1179538270=:14599
Content-Type: multipart/alternative;
boundary="0-1847349128-1179538270=:14599"
================================================== =======


As received from Bellsouth:
================================================== =======
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-998960767-1179538430=:
77758"
Content-Transfer-Encoding: 8bit
Message-ID:
X-Spam: [F=0.0001631925; S=0.010(2007050201); MH=0.500(2007051861);
R=0.015(s12/n761)]
X-MAIL-FROM:
X-SOURCE-IP: [(unknown)]
--0-998960767-1179538430=: 77758
Content-Type: multipart/alternative;
boundary="0-1254677949-1179538430=:77758"
================================================== =======