I got caught by this one. A colleague of mine got this response when trying to send an email message containing several attachments to a user:
This is an automated message from the xxxx Email Security Appliance at host xxxx.xxxx.xxxx.
A mail from you (xxxx) to (multiple recipients) was stopped and Discarded because it contains one or more forbidden attachments.
Summary of email contents:
Attachment: PBSP Terminology Guide.pdf
Attachment: FAA_Sample_BICM.DOC
Attachment: Behavioral Deficit Observation Form.docx
Attachment: [Content_Types].xml
Attachment: .rels
Attachment: document.xml.rels
Attachment: document.xml
Attachment: header1.xml
Attachment: theme1.xml
Attachment: thumbnail.jpeg
Attachment: settings.xml
Attachment: printerSettings1.bin
printerSettings1.bin forbidden attachment (detected as ”) (filename)
Attachment: webSettings.xml
Attachment: app.xml
Attachment: core.xml
Attachment: styles.xml
Attachment: fontTable.xml
Attachment: Behavioral Deficit Observation Form.pdf
Attachment: Time_Sampling_Prepared.docx
Attachment: [Content_Types].xml
Attachment: .rels
Attachment: document.xml.rels
Attachment: document.xml
Attachment: theme1.xml
Attachment: thumbnail.wmf
Attachment: settings.xml
Attachment: fontTable.xml
Attachment: webSettings.xml
Attachment: core.xml
Attachment: styles.xml
Attachment: app.xml
Attachment: 27 PBIP Compilation.doc
OK, so there is a document titled printerSettings1.bin that is causing the issue. This, of course, wasn’t any of the attachments so I figured it’s some weird display code that Outlook is putting on the email, like through a theme or something. Well, that wasn’t it. So I did a quick Google search on printerSettings1.bin. Apparently this is a file within the new xml format of the Office 2007 documents.
In this case, the Word 2007 document, Behavioral Deficit Observation Form.docx contained all the files listed below it. As some of you may or may not know, the new office formats (docx, xlsx, pptx, etc) are actually zip files which you can open and view the contents. Sure enough, when I opened this file I saw the printerSettings.bin file. It was the *.bin extension that was throwing the red flag on this email scanner.
The weird thing was that there was another docx file in the attachments, yet this one did not have the printerSettings1.bin file. I’m not sure what causes this file to be created; obviously something that affects printer properties. The page was landscaped so it could be as simple as that.
Anyway, there weren’t any Word 2007 features in the doc so I recommended that he simply save it as a Word 2003 file.
If this bites us again I may search for more detail, because there isn’t a whole lot on the web as to the specifics on what causes this file to be created and if it can simply be removed from the archive without any adverse effects (such as removing the landscape setting).
For now, this quick 2 minute fix solves the problem and I can get back to work. 🙂