Email message when closing forwarded emails with attachments: "The properties of the message 'Attached Image' have been changed"

Hello,

Very recently some Users are receiving the message:
The properties of the message "Attached Image" have been changed

They receive this intermittently and only when forwarding an email sent to them with an attachment. Performing the same function on the same email may not always result in the message appearing. When it does appear the email forwards without issue but when closing the original email (the one forwarded) this message appears. No action was taken on the attachment - none. A simple received email is opened and then forwarded.  

Message Screen shot:
SendEmailAttachmentMessage.PNG
(2) Windows 7 machines - new installs using Outlook 2010, fully updated.
(1) Windows 8 machine - 8 month old installation, Outlook 2013 fully updated. Win 8 machine had this issue after the Win 7 machines started seeing it.
Other Win 7 and Win 8 machines not having the same problems.
Exchange 2010 RU4  - fully updated on September 25th.

Thoughts?
LVL 14
Michael MachieIT SupervisorAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Gerwin Jansen, EE MVETopic Advisor Commented:
What kind of Antivirus do you have on PC's and exchange server?
Did you check for malware on a PC that has the issue using MBAM for example?

https://www.malwarebytes.org/antimalware/
0
Lionel MMSmall Business IT ConsultantCommented:
This is simply because the attachment is saved in a temp folder before opening; not all of them are and those that are get seen as changed--you can see which files are saved to the temp folder by clicking on "save as" to find the location where these are saved, temporarily saved--they should be deleted if closed. I usually get this message when I open the attachment, leave it open and then close the email.
0
Michael MachieIT SupervisorAuthor Commented:
@Gerwin:
The two Windows 7 machines are fresh installs. They are actually fresh images that were installed onto 5 identical machines - only two of the 5 have this issue. TrendMicro Office Scan is the AV - I will run this and then MalwareBytes to rule out a virus/malware.

@lionelmm:
I am familiar with what you mention. The main difference is the attachment is never opened. I will re-confirm this but when I saw it happen on two of the three machines the attachment had never been opened. The email was received and immediately forward.

Updates to follow.
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

Lionel MMSmall Business IT ConsultantCommented:
so all they are doing is opening the email, clicking on forward and hitting send and then they are getting this error? if so, this is highly unusual--I have never seen that before.
0
Michael MachieIT SupervisorAuthor Commented:
@Gerwin:
MalwareBytes, ESET, Sophos, TrendMicro, ComboFix, HitmanPro, AdAware, Kapersky - all used, nothing found.
I forgot to mention that I did run these on the Exchange 2010 Server as well to rule in/ out your suggestion but nothing found there either.

@lionelmm:
Yep, very odd. I don't know what would have this start occurring out of the blue for only three staff. I was hoping someone would have seen this oddity in the past. I have reconfirmed with the Users that they are indeed NOT opening the attachment before forwarding. I can perform the same action from my PC with the same email and not have the problem. Hmm, now that I state this I will try  by logging into my account on the affected PCs and see if the issue remains. If not, perhaps it is a profile issue?
0
Lionel MMSmall Business IT ConsultantCommented:
The only reason an attachment should change is if your security software finds something and cleans it up and/or deleted the attachment--this is apparently not the case since you can forward the same email without this happening. Is this happening to these users for all attachments of just some and are the attachments giving this error coming from the same sender?
0
Gerwin Jansen, EE MVETopic Advisor Commented:
Do the users have a preview pane in Outlook? The addin that previews the attached file could maybe modify it. Try disabling the (mail) preview and then forward a message.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Michael MachieIT SupervisorAuthor Commented:
@lionelmm:
All variables are different.
Immediately repeat the process with the same sender to the same forwarded recipient and it will occur and then not occur. Different attachments with the same behavior - no error once, error the second time etc. No pattern that I can see. I will however disable the antivirus for testing purposes - that is a good thought. The AV could be performing a scan on the outlook temp folder at the same time...hmm, I'll get back to you on that.

@Gerwin:
That is also a good thought. I will check because I never took notice actually.
0
Michael MachieIT SupervisorAuthor Commented:
@lionellmm:
Disabled A/V and set it to not auto-load on bootup (perm disabled). Rebooted, issue re-appeared. Verified A/V was not on. Dang..

@Gerwin:
One of the three affected Users has the Preview enabled. Coincidentally this is the primary User I am working with to identify the problem and fix. Disabling the preview, closing Outlook, rebooting, launch outlook, verify preview is still disabled - issue remains. Dang..

Now, interestingly enough, I did notice a new little feature in emails with attachments I had not noticed before. All three of the affected Users have the newest Adobe Acrobat DC Pro software installed, which installs an Outlook add-on called 'Adobe Track & Send'. This allows you to send the email through Adobe's servers and track it and/ or request signatures on the attachment. As soon as I saw this I considered that perhaps this feature was tagging the attachment in some way, otherwise how could the add-on perform any functions on this attachment?

I disabled that add-on, re-launched Outlook, and attempted to replicate the problem.. Voila! No messages! Considering I had just replicated the problem no less than a dozen times in a row using the exact same sent email to forward, and now after disabling that add-on I could not replicate the problem after 20 attempts, I think that was the culprit.

However, one other User has this same software and add-on installed but he is not receiving these messages. Same PC image for these machines on identical hardware, but I installed Adobe DC Pro separately on each PC, not as part of the image deployment. I remember one installation that was slightly different than the others but do not remember which PC it was, so assume the unaffected PC was the one with the different installation options.

I will monitor and provide an update.
2
Michael MachieIT SupervisorAuthor Commented:
Hi All,

Yes, it was the Adobe Track&Send Outlook add-on installed with the new Adobe DC Pro software.

I appreciate your efforts and I will close this question.
1
Michael MachieIT SupervisorAuthor Commented:
I've requested that this question be closed as follows:

Accepted answer: 0 points for Machienet's comment #a41067985

for the following reason:

The issue was directly caused by the Adobe Track&Send Outlook add-on adding a tag to the forwarded attachment, even though the option was not being specifically selected. As soon as that add-on was disabled the issues went away.

Confirmed on all three affected PCs.
0
Gerwin Jansen, EE MVETopic Advisor Commented:
Great find :) So an add-in after all.
0
Michael MachieIT SupervisorAuthor Commented:
You know, good point. I had forgotten you mentioned the Preview add-in which actually did lead me to look at the Track&Send...

You deserve some points, my apologies.. let me object and close properly to award some points.
0
Michael MachieIT SupervisorAuthor Commented:
Although it was not the Preview add-in that was the specific reason, it was still an add-in that caused the problem. The comment from Gerwin got me looking at the add-ins to notice Track&Send.

Gerwin deserves some credit here.
0
Gerwin Jansen, EE MVETopic Advisor Commented:
No problem, I wasn't after any points ;) Just glad you found it... But thanks!
0
Michael MachieIT SupervisorAuthor Commented:
Understood - still deserved..
0
Lionel MMSmall Business IT ConsultantCommented:
I think I deserved pints too--told you that only way attachment could change is if AV is reading it and cleaning it. What you discovered was indeed that something was changing it. The fact that you did not tell us/me about all the add-ons is your fault--we can't be mind readers and know how you have outlook setup. Preview is not an addon--its is a feature of Outlook.
0
Michael MachieIT SupervisorAuthor Commented:
Hi Lionelmm,

My intention was not to disclude (is that even a word?) anyone for any reason and I originally closed it without assigning points at all. I also had no intentions of upsetting anyone by not awarding points originally. I truly appreciate your time and effort with trying to help me, I really do. Participation from people such as yourself, and myself for others, is what this is about. However, Gerwin's closing statement reminding me that, by my word, the problem originated from an add-on prompted me to review all the suggestions to make sure I awarded credit if anything said in a comment assisted me in finding the fix. His comments were the only ones mentioning add-ins (see my examples below), and although it was not a 'preview add-on' since one does not exist, it still prompted me to look at add-ins - hence the 'C' grade solution awarded to Gerwin rather than a 'B' or 'A' grade. I awarded points solely on the word add-in because that was the reason when all was said and done.

To further clarify my reasoning, and I am only doing this because you seem upset, is to look at your suggestions one by one (below). If after reviewing my reasoning you feel you deserve points for this please Object to me closing the question, provide your reasons for Objecting, and the Moderators will take a peek and make a decision. I hope this one situation does not change your view of EE in any way and hope you continue to offer your valued insight to those needing help. I personally thank you again for your contributions.
_____________________________________
ID: 41039582
This is simply because the attachment is saved in a temp folder before opening; not all of them are and those that are get seen as changed--you can see which files are saved to the temp folder by clicking on "save as" to find the location where these are saved, temporarily saved--they should be deleted if closed. I usually get this message when I open the attachment, leave it open and then close the email.

** This was not the case. No mention of add-ons**
______________________________________
ID: 41041494
so all they are doing is opening the email, clicking on forward and hitting send and then they are getting this error? if so, this is highly unusual--I have never seen that before.

*This comment was asking me to confirm the scenario. No mention of add-ons*
______________________________________
ID: 41042172
The only reason an attachment should change is if your security software finds something and cleans it up and/or deleted the attachment--this is apparently not the case since you can forward the same email without this happening.

* Security software was disabled and was not the culprit. No mention of add-ins. As we have all just learned add-ins can make changes to a document, even if we cannot see the changes, as was discovered with this issue.*
_______________________________________
ID: 41042290
Do the users have a preview pane in Outlook? The addin that previews the attached file could maybe modify it. Try disabling the (mail) preview and then forward a message.

*Add-in mentioned - points at 'C' grade awarded since it was only a reference to add-ins that led me to look at them*
________________________________________
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Outlook

From novice to tech pro — start learning today.