What can cause mutated Word document attachements?

Question

We are sending out Word documents via email (automated system, not by hand). The email is sent to the user, and CC'd to me.

We are getting reports that some users are having the attachments come through corrupted, though when we open the copy that is CC'd to me, it opens fine.

When the user forwards us the copy they received, then we cannot open it.

Below is a hex comparison of the two files. Can anyone identity what is going on here?

Message headers are below

Return-Path: <info@example.co.nz>
Received: from animal.hosts.net.nz (root@localhost) by example.co.nz
 (8.12.11/8.12.11) with ESMTP id m8T52Mw6021168; Mon, 29 Sep 2008 18:02:22
 +1300
X-Clientaddr: 210.48.108.196
Received: from marjory.hosts.net.nz (marjory.hosts.net.nz
 [210.48.108.196]) by animal.hosts.net.nz (8.12.11/8.12.11) with ESMTP id
 m8T52EvU028021; Mon, 29 Sep 2008 18:02:19 +1300
Received: from example.example.co.nz ([210.48.67.48]) by
 marjory.hosts.net.nz with esmtp (Exim 4.63) (envelope-from
 <info@example.co.nz>) id 1KkAtd-0004Ch-I9; Mon, 29 Sep 2008 18:02:09 +1300
Received: from localhost ([127.0.0.1]) by example.example.co.nz with esmtp
 (Exim 4.63) (envelope-from <info@example.co.nz>) id 1KkAtV-0001C3-4s;
 Mon, 29 Sep 2008 18:02:01 +1300
From: "XXX" <info@example.co.nz>
To: "Sue" <sue@example.co.nz>
Reply-To: jayar_navarro@example.com
Subject: XXX: new application received
Date: Mon, 29 Sep 2008 18:02:01 +1300
Content-Type: multipart/mixed;
 charset="utf-8";
 boundary="=_5549133ca51ec83196e2cfd28dad40f7"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
MIME-Version: 1.0
Message-ID: <E1KkAtV-0001C3-4s@example.example.co.nz>

---

I think I know what it is, but not why it is happening.

"X-Mimeole: Produced By Microsoft Exchange V6.5" the client is using Exchange. Now, compare these lines.

The original:

Content-Type: multipart/mixed;
 charset="utf-8";
 boundary="=_5549133ca51ec83196e2cfd28dad40f7"

What they get:

Content-Type: multipart/mixed;
 boundary="----_=_NextPart_001_01C92270.6BBA3EE6"

The missing charset="UTF-8" likely means that the client will fall back to Windows-1252, which I think (can someone confirm?) result in corrupted attachments.

Now the question is, why would the char-set be stripped?

Answer 1

The first 3 characters are missing in the corrupted one - compare

// Your correct version
00000BC0 0D 0D 0D 41

// Their corrupted one
00000BC0 D0 D4 1...

Either their mail server, mail program, anti-virus or some such program has removed the first few chars, which seems to be causing the confusion when Word tries to open it.

The fact that the file is still garbled when they send it back to you confirms that something is altering the file on their side once received.

Answer 2

Not sure what happens, but have you tried a compressed file? That sometimes solves the problem of corrupted email attachments.