Advice Request Outlook Attachements adding underscore to file extension

[superleeds27]

Hi all.

I've recently noticed that attachments that's come through the Outlook app have an underscore after them. It means I have to save, remove the underscore and then open them.

Found a thread on MS and it seems to be Kaspersky related?

Outlook attachment's file extension changing

Hi, I have recently come across 2 users from different organization complaining that their outlook 2016/2019 attachment's can not open. upon checking I noticed this: .xls showing as .xl_ .pdf showing

answers.microsoft.com

Anyone else have this?

 

[harlan4096]

Yes, this is due to Kaspersky Mail-AV Attachment filter:



Just disable it if You don't want this behaviour...

You can find some threads about it also in Kaspersky Community

 

[superleeds27]

How has this managed to get through to production?

Kaspersky Support Forum

Kaspersky forum where Kaspersky product users and experts share tips, advice, help and solutions in your preferred language

community.kaspersky.com

If I removed my account from Outlook and re-added it, so it redownloaded all my emails, would this fix it? All previous emails in Outlook that have attachments have been affected!

@harlan4096

 

[harlan4096]

If I removed my account from Outlook and re-added it, so it redownloaded all my emails, would this fix it? All previous emails in Outlook that have attachments have been affected!

I think they released this new feature with the module enabled by default

so it redownloaded all my emails, would this fix it? All previous emails in Outlook that have attachments have been affected!

Yes, probably, or You can use a renamer tool...

 

[superleeds27]

I think they released this new feature with the module enabled by default



Yes, probably, or You can use a renamer tool...

Its ridiculous that they've done that, if im being honest!

I've got a new laptop that has Kaspersky installed with no Outlook installed.

Disabled that filtering, installed office and Outlook, Added my account. Files still have the underscore!

This is ridiculous.

Edit: Seems to be things in the Inbox only, Folders look like they may be okay?

Edit Two:

Not sure when this started? 7th December I have files that haven't been modified by Kaspersky? It could be when I installed the 21.2 manually.

So it may just be a few weeks worth of emails, so a handful of emails with attachments.

 

[harlan4096]

Which type of account is POP or IMAP?

 

[superleeds27]

Which type of account is POP or IMAP?

Office365 and Hotmail - So IMAP.

Sent a few tests to myself with the usual attachments, pdf, images etc and they're all coming through fine on both machines now.

Might just be a handful of attachments i have issues with. December wasn't really a busy email month tbf!

 

[harlan4096]

I guess K. Mail AV attachment filter can't or is not able to modify files attachments in remote server, and probably it does once files get local systems... so I find weird what You said

 

[superleeds27]

I guess K. Mail AV attachment filter can't or is not able to modify files attachments in remote server, and probably it does once files get local systems... so I find weird what You said

I mean. The tests I've just done seem fine now, with sending and receiving.

Will keep an eye on it when someone else sends me something.

Still rather annoying that this has even happened!


Edit:
Was an issue with updating from 21.1 to 21.2

In some scenarios after upgrade from version 21.1 to version 21.2 the settings of the attachment filter do not switch to default configuration and some other extention types are enabled. We are investigating this inssue in frames of bug 4575990.

 

[harlan4096]

Still rather annoying that this has even happened!

Yeah, in Kaspersky Community there are many complains about that

 

[superleeds27]

Yeah, in Kaspersky Community there are many complains about that

Installed 21.2 manually on the 15th December. So I'm guessing attachments between then and today will be affected.

Still find it weird how the ones in that timeframe in my inbox when logging into Outlook via the web still have the underscore?

 

[superleeds27]

Yeah, in Kaspersky Community there are many complains about that

@harlan4096 This will be why.

Kaspersky product checks attachments when they are being downloaded. Depending on the mail program sync settings, in some situations only a preview of the email is downloaded, leaving the attachments of the emails on the remote server. As soon as you open the email to view the attachments and contents, the mail program downloads them and the Kaspersky product renames the attachments. The next thing that happens: Outlook syncs the changes with the server and the extentions get changed on the server as well.

So anything that landed in my inbox between the 7th and today, will have had that file extension rename. Attachments before that should be fine.

 

[harlan4096]

Still find it weird how the ones in that timeframe in my inbox when logging into Outlook via the web still have the underscore?

Agree...

Update: so I see, OutLook sync upload the changes to server, that can be the answer, I guess in POP accounts probably this issue of syncing changes will not be there...

 

[superleeds27]

Agree...

Update: so I see, OutLook sync upload the changes to server, that can be the answer, I guess in POP accounts probably this issue of syncing changes will not be there...

No i guess not.

Thankfully it will only be new emails that came in to the inbox within that time frame, opened on the machine, then the email changes to the attachment are synced back to Office365/Hotmail etc.

Existing emails in folders from months/years back wont/shouldn't have been affected (Haven't been affected for me anyway) - Only 'New in' items I think.


So in theory, I probably have an issue with around 5-10 attachments at the most, thankfully.

Will have to keep an eye on things like this as it could potentially cause a massive headache!

 

[superleeds27]

Seen someone say all their emails with attachments dating back a good 10 years have been affacted. I can't see how? Surely the only time Kaspersky would scan and change is when the email first lands into the inbox?

This hasn't been an issue for me, just the emails within that 4 week timeframe i mentioned above, 7th December to 6th Jan.

Edit.

Only thing I can think of is that the emails in that folder they had where 'Archived' stored on the server but not local. When you hit the folder, you can download the messages from the server to Outlook. That's when they'd be scanned and changed.

Edit Two

Yep. They downloaded everything from the server to Outlook to create a local backup, at the time Kaspersky had the issue.. So that's how older items have been affected! Ouch :/