The mail server says it deleted an image file that could be a virus – why?

You may find that an incoming email triggers a message from the mail server’s anti-virus system saying that an attachment has been deleted because it could carry a virus. Normally this only happens to files with the following file names:

.scr

.pif

.vbs

.shs

.exe

.com

.bat

.hta

So it seems strange that a simple JPG image file should be deleted by the system – especially as JPG itself is a very widely used image standard.

The explanation lies in the name of the file: if you send an attachment with Danish letters such as æ, ø or å in its name, some email programs change the name of the attachment from, for example:

Værdiskab_01.jpg

to

Værdiskab_01.jpg-=?ISO-8859-1?Q?V=E6rdiskab=5F01.jpg?=

The anti-virus system therefore sees the file extension as

.jpg?=

– which isn’t a valid file type. So the system regards it as an attempt to “sneak” a virus-carrying file past the anti-virus system, and responds by deleting the file. The solution is to change the file name to, for example:

Vaerdiskab_01.jpg

– after which the file goes through without a hitch. Please note that apparently not all email programs change the file name, so some users will no doubt find that they can send attachments with international characters in the file name.