Overview

Emails that contain images in the signature are blocked. This issue is caused because the Attachment Checking filter determines that there is a file category mismatch, with an error message similar to the following:

Claimed extension <extension1> - claimed category <extension1>, detected category <extension2>

where the <extension1> and <extension2> refer to the extensions configured in the rule CONTENT POLICY: Block all potentially malicious attachments.

Solution

There is a workaround that can help prevent this undesired behavior. It involves modifying the registry settings to fix the mismatch: 

• Go to Start > Run > and type regedit to open the registry.

• Navigate to the following key:

  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GFI\MailEssentials\EmailSecurity\Engines\AttachChecker\BlockByAssocExceptions

• Locate the existing key from the <extension1> that is allowed, and add the corresponding value for the <extension2>you wish to allow. For instance, 

  • If you get an error message Claimed extension jpg - claimed category jpg, detected category BMP, then find locate jpg and add the value [19] which is the number for BMP, i.e. the existing key will have 'JPG- [10]' and you will have to change it to 'JPG- [10],[19]'. 
  • If you get an error message Claimed extension emf - claimed category emf, detected category JPG, then find locate emf and add the value [10] which is the number for JPG, i.e. the existing key will have 'EMF- [20]' and you will have to change it to 'EMF- [20],[10]'. 
  If there is no <extension1>key, please add it as a String Value with a value of <extension2>
• Close the registry editor and restart the GFI MailEssentials attendant service.

Testing

After restarting the GFI MailEssentials attendant service, emails with images in the signature should no longer be blocked.

If the issue still persists, please generate the troubleshooting logs as follows:

• Make sure that we have tracing enabled.
• Wait for at least 30 minutes to gather enough information and for the issue to be reproduced.
• Run the troubleshooter:
  1. Start > Programs > GFI MailEssentials > Troubleshooter
  2. Follow the Log Generation Wizard for collecting the required and pertinent information.
  3. Select New Case when completing the log generation.