1

This is a problem I have had for some time, but it has until now been considered relatively minor (by myself and my colleague) so we haven't really tried to fix it. However, a couple of weeks ago an unfortunate series of events could have been avoided if the Server Performance Report email for that day had been legible, so now we have decided to try and fix it.

The problem is that every so often, in a seemingly random manner, the Server Performance Report email comes through as an un-decoded multipart MIME structure, like this:

This is a multi-part message in MIME format.

------=_NextPart_000_0000_01CCB4A5.81987E80
Content-Type: multipart/alternative;
    boundary="----=_NextPart_001_0001_01CCB4A5.819D3970"


------=_NextPart_001_0001_01CCB4A5.819D3970
Content-Type: text/plain;
    charset="utf-8"
Content-Transfer-Encoding: base64

U2VydmVyIFBlcmZvcm1hbmNlIFJlcG9ydCBmb3IgR0NTDQpSZXBvcnQgY3JlYXRlZCBvbiAxMi83
LzIwMTEgYXQgNjowMCBBTQ0KIAkNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoN
CgkNCg0KDQoNClN1bW1hcnkgZm9yIFNFUlZFUjAxDQoNCiAJU2VydmVyIGhhcyBiZWVuIHJ1bm5p

...and so on...

When I view the message options in Outlook, I find that the boundary for the outer structure has been stripped from the Content-Type: header (which is obviously the reason it cannot be decoded) - here is a direct copy/paste of it:

Content-Type: multipart/related;
    boundary=

...BUT, this only happens about 40% of the time. For example, todays came through fine, yesterdays and Tuesday's were broken, Monday's was fine. Last week everything was fine all week. The week before, 4 were broken and 1 was OK.

I have looked through event logs for any errors, or a pattern of any kind that corresponds to when the emails are broken/not broken, and cannot find anything.

It has the feel of a problem caused by AV to me - we use AVG Internet Security 2010.

The Question(s)

  • Has any one ever come across this before?
  • Does anyone have any idea what might be causing this?
  • Does anyone know how to fix it?

TIA

DaveRandom
  • 702
  • 1
  • 8
  • 15
  • Can you try to have the report sent to a different email address, to rule out that the receiving smtp server corrupts it? Or, is this all handled by the local Exchange SBS server? – Lucky Luke Feb 18 '12 at 21:33
  • @LuckyLuke All on the same box I'm afraid. The receiving Exchange server sits runs on the source server, so everything will be done via loopback - so I can't even sniff the network traffic out (or not without *a lot* of messing around, anyway). – DaveRandom Feb 19 '12 at 21:53
  • Did you get a chance to try my solution? – Lucky Luke Feb 24 '12 at 16:17

1 Answers1

1

It looks like you are right, this problem is caused by AVG Antivirus. Quite a few people seem to have this problem.

Exclude the following exchange directories from the AVG Resident Shield, the default path c:\program files\Exchsrvr:

  • Mailroot
  • CONNDATA
  • MDBDATA
  • MTADATA
  • SCHEMA

(I took this from a forum post). Take a look at these links as well for more details:

Lucky Luke
  • 1,634
  • 1
  • 11
  • 12
  • I am going to call this the answer because I have not had any issues for the couple of days since I implemented it, although since the problem was apparently completely random and intermittent, only time will tell whether it has actually fixed the problem. Many thanks for putting the time and effort to find a solution... Although I am going to have to properly research the implications of excluding all that from the AVG resident shield, in case I am now open to nasties getting in. I'd rather have broken reports than a security hole... – DaveRandom Feb 25 '12 at 21:48
  • Maybe you can confirm whether it does indeed solve the problem for others. You have a valid point regarding security, but I don't think that excluding those directories would open yourself up to any attacks. Most A/V software requires you to exclude a variety of directories in order to avoid conflicts unfortunately. – Lucky Luke Feb 27 '12 at 14:22
  • `Maybe you can confirm whether it does indeed solve the problem for others` - Indeed, I will update after a couple of weeks of no problems :-) – DaveRandom Feb 27 '12 at 16:59
  • Looking good so far, no bad emails in the last couple of weeks. I think this is definitely the right answer. – DaveRandom Mar 06 '12 at 11:13