Email message in Outlook changed to draft by ESET

[kevint8 0]

Anyone run into issues with ESET Antivirus changing the email message properties in the Inbox and turned it into a draft message?  From time to time, I would receive an email message from a colleague and when I click open the message, or reply to the message, it would open the message up as a draft instead.  I contacted Microsoft support on this and they concluded that the ESET Antivirus application for some reason is changing the message properties and turned it into a draft.

 

Any ideas?

 

 

[CB530 70]

Hi Kevint8,

Are you sure that you're not just opening the message and creating a new draft before you send your response? This happens automatically in the latest version of Outlook, any time that you open a message to reply to it, a draft is created.

[Marcos 5,277]

What version of ESET Endpoint Antivirus, MS Outlook and Windows are you using? Does disabling integration with MS Outlook in the advanced setup make a difference?

[kevint8 0]

Hi Kevint8,

Are you sure that you're not just opening the message and creating a new draft before you send your response? This happens automatically in the latest version of Outlook, any time that you open a message to reply to it, a draft is created.

 

Yes, I am sure.  When I open the message, it is addressed to me and the from line has the sender name on there.  I went through the troubleshooting with the Microsoft support engineer and they pulled this out of the sync log:

 

11:33:03 Overwrite property: 0x007D001F

11:33:03 Overwrite property: 0x3FFA001F

11:33:03 Overwrite named property: EsetMessageFlag

11:33:03 Overwrite named property: Emon Scanner Build

 

He explained that the message property type is being modified to draft by ESET as shown above. 

 

I am running version 6 and Outlook 2010 on Windows 7 Pro 64bit.  Will have to try disabling the integration to see if it makes a difference.

 

Thanks.

[Marcos 5,277]

Property conflicts do not cause a message to be open from the Draft folder instead of Inbox. If a message is concurrently modified by ESET on a client (e.g. by appending a tag with the scan result) and on the server, the message should appear in the Sync issues / Conflicts folder.

[kevint8 0]

Property conflicts do not cause a message to be open from the Draft folder instead of Inbox. If a message is concurrently modified by ESET on a client (e.g. by appending a tag with the scan result) and on the server, the message should appear in the Sync issues / Conflicts folder.

 

It's not opening the folder from the Draft folder.  It's opening up the message as a draft but it's in my Inbox folder.  The message first comes into my folder as an email message but ESET for whatever reason changes the message type to draft instead.  So when I open up the message to view, it opens it up as though it's a saved draft email.  I checked with the user who actually sent the message and the same message appears as a regular email message in his Sent folder. 

 

Also ESET is installed on the client machine only.  Exchange server is never touched by ESET. 

[skello 0]

This has been going on for about 3 months for my company. We have to make sure we disable the ESET plugin to stop this from happening. We still haven't found a fix.

[UTS 1]

I can confirm this is an ESET issue.  I am the owner of a technology company which, in part, provides managed services to other companies and is a Microsoft and ESET partner.  I have worked with Microsoft on this issue and we have determined that the issue lies with ESET.  Please post a solution if any is available.  I will be in contact with ESET tomorrow to try and get to the bottom of this and will post the fix if we find one!

Thanks,

Sean

[Marcos 5,277]

The issue was also reported on a Microsoft's forum by a user with only MSE installed:

I only have Microsoft Security Essentials running, you would think that Microsoft's own product wouldn't break Outlook.

[Marcos 5,277]

If possible, please create a video that would demonstrate how to reproduce the issue. We've tried to reproduce it with MS Outlook 2013 installed on 2 computers and concurrently accessing emails in a Gmail mailbox to no avail (sync issues were occurring for an obvious reason but this had no effect on the issue with messages opening as draft).

 

Also please confirm or deny whether you can reproduce it with a Gmail account.

[dromanczuk 0]

I Think the problem is only on computers with Windows 7 64bit. I bought computer with Windows 64bit and installed on it MS Office 2013 with eset nod for 64bit. On Windows 32 bit everything was fine. 

Edited November 12, 2013 by dromanczuk

[moth 0]

Same problem here. Happening to 3 out of about 60 users, all on EEA 5.0.2214, all Windows 7 64bit. 2 have Outlook 2010, 1 has Outlook 2013. Connected to Office 365 for Exchange.

 

See attached image. 'Invoices' is the user mailbox, the blacked out From is the sender. Looks just like a draft, but it's an incoming message.

Edited November 20, 2013 by moth

[tuntun 0]

Does this solve in latest 5.0.2225.0?

Thanks

[moth 0]

Installed 5.0.2225 a few days ago and no one has complained about the issue since.

[Marcos 5,277]

Please confirm that upgrading to the latest version of Endpoint fixed the problem for all of you who have reported it.

[moth 0]

I've just had an instance of this still happening on 5.0.2225. Same user, same issue. From what I have seen, this is only happening when there are PDF attachments.

[geosoft 18]

Just out of curiosity, are you guys installing x64 version of Office 2013 or x86? Maybe it's a bitwise issue? I haven't seen the issue in our office, but our deployment of Office 2013 is currently limited, and we are only using x86 of the office install as recommended by Microsoft.

 

I'll keep my eyes peeled for this.

[moth 0]

Of the 3 machines I am aware of with this issue, all are running the 32 bit version of Office.

[globalit 0]

We are seeing the same problem on Smart security 7, version 7.0.302.26. This has been an ongoing issue for clients using Eset for the past 12 months or more.

 

When they have 2 PC’s open, using outlook OWA with the same email account; in this case, sharing an email box or home and office PC’s. Eset tags the item as draft on one of the PC’s and you are now unable to respond to the email on the other PC, the headers have been removed. You are forced to go to the other PC to open the email that was tagged by Eset and reply or view headers.

 

The work around is:

1. Disable Eset add on, however what is the point of even having eset if you can’t use it for Anti-Virus. Plus Eset turns itself back on anyway.
2. Turn off the email on the other PC.

 

In 2013 we were looking for blogs on this issue and had reported it to Eset without response, however finally now there is some discussion; still no fix though.

[Marcos 5,277]

According to hxxp://community.office365.com/en-us/f/158/p/160948/475085.aspx?PageIndex=1, the issue occurs regardless of the antivirus program installed. A Microsoft representative responded there so they were aware of the issue. Somebody responded: "We had this issue for probably 6 months, Microsoft collected a bunch of diagnostics/logs from me and was working on it for a long time. They contacted me last week looking for more diagnostics saying that they are close to having a fix. But when I went to gather some emails that had suffered from the issue, I couldn't find any. It seems some kind of divine intervention happened and it started working correctly again......fingers crossed.
P.S. I didn't change anything on my side."

 

Another person fixed the issue as follows:

"I saved everything that was in my account (inbox and outbox) to another offline folder (another PST folder). I deleted the corrupted account and recreated the account using my old account settings and all is well now. Hope this helps someone."

[mrgrattan 1]

Hello,

 

We ran into this exact problem with Exchange 2013 and outlook 2007 and 2013 clients. We solved this by making sure the clients were set to access Exchange via Cached Mode.

 

Regards,

Mike Grattan

[p4ulmac 0]

I've got this happening with Exchange 2013, Outlook 2007 and 2013 clients. Tried Mike's solution above, but still happening. Does anyone have a definitive answer? We're running ESET Endpoint (5.0229).

[Marcos 5,277]

Try installing Endpoint v6 on a test machine. It's not available in Europe yet but you can download it from hxxp://www.eset.com/us.

[blackcat 0]

We have the same problem. The problem is most common when using the shared account. Disable the Eset plugins decreases but does not eliminate the problem. Turning off the email client integration is not a viable solution.

 

Update: We have the following issue: Every message that Eset identified as infected, causes a conflict and the message becomes draft. No other solution than disable Eset integration?

Edited January 28, 2015 by blackcat

[Surfergirl 0]

We are tracking this problem for more than 6 months. Our environment is Exchange Server 2013 CU3, client Outlook 2010 -32Bits- Pt-BR (Office 2010 with KB2910899 update applied), ESET Endpoint Protection v.5.0.2237 and Windows 7 Pro - 64Bits - PT-Br. Accounts are Microsoft Exchange by default and shared accounts are automapped.

These tests were performed with ESET´s Outlook Integration enabled.

The problem shows up in shared accounts or regular accounts with delegated Full Control Access (the same concept as shared accounts).

We are certain that:
1) If every client Outlook has cached mode disabled, 100% messages arriving in the shared account´s Inbox will be changed to DRAFT;
2) There´s a side effect of ESET antispam Engine in Integration mode: Spam messages to shared accounts, moved by ESET antispam or Outlook filters to Junk Mail folder are replicated to Conflicts folder of every user in the shared account group. So users of shared accounts, that receives a lot of Spam, have also problems with their individual quota.
3) If we turn off Eset´s Outlook Integratin there will be no more Draft or replicated Conflict messages.

This is a sample of a Sincronyzation Error generated by a "Test 1" message replicated to Conflicts, note the action of ESET Scanner,Antispam and MessageFlag over the message.

Modification Resolution
13:55:04 Message class: {SU:IPM.Note}
13:55:04 Mail Conflict Resolution
13:55:04 Local subject: {SU:Test 1}
13:55:04 Remote subject: {SU:Test 1}
13:55:04 Local Message Entry ID: {CB:70,
LPB:0x0000000079D40DC4BC3B0B4182AB0107FFDC47BE0700C62503EBA7B44047BDE0658206614692000000263D1B0000043A2B9AE31B074C998286A62DC949A10000B9372AB70000}
13:55:04 Remote Message Entry ID: {CB:70,
LPB:0x00000000120B0CAEFBC41D459249FAB583569E330700C62503EBA7B44047BDE0658206614692000000263D1B0000043A2B9AE31B074C998286A62DC949A10000B9372AB70000}
13:55:04 Local Message ChgKey: {CB:20, LPB:0x69904AA2787815419869D58B3CD3D44F00002E4C}
13:55:04 Remote Message ChgKey: {CB:22, LPB:0x043A2B9AE31B074C998286A62DC949A10000B93819C2}
13:55:04 Local Message PCL: {CB:44, LPB:0x16043A2B9AE31B074C998286A62DC949A10000B93819C01469904AA2787815419869D58B3CD3D44F00002E4C}
13:55:04 Remote Message PCL: {CB:23, LPB:0x16043A2B9AE31B074C998286A62DC949A10000B93819C2}
13:55:04 Checking local modifications
13:55:04 Compare property: 0x007D001F
13:55:04 Ignore property: 0x3FFA001F
13:55:04 Compare named property: Emon Scanner Build
13:55:04 Compare named property: EsetAntispamMsgHeader
13:55:04 Compare named property: EsetMessageFlag
13:55:04 Getting remote properties
13:55:04 Checking remote modifications
13:55:04 Compare (conflict) property: 0x007D001F
13:55:04 Local: {SU:Received: from SERVER.xxx.br (10.11.39.46) by SERVER.xxx.br
 (10.11.39.46) with Microsoft SMTP Server (TLS) id 15.0.775.38 via Mailbox
 Transport; Tue, 10 Feb 2015 13:54:32 -0200
Received: from SERVER.xxx.br (10.11.39.46) by SERVER.xxx.br
 (10.11.39.46) with Microsoft SMTP Server (TLS) id 15.0.775.38; Tue, 10 Feb
 2015 13:54:31 -0200
Received: from SERVER.xxx.br ([::1]) by SERVER.xxx.br ([::1]) with
 mapi id 15.00.0775.031; Tue, 10 Feb 2015 13:54:31 -0200
13:55:04 Remote: {SU:Received: from SERVER.xxx.br (10.11.39.46) by SERVER.xxx.br
 (10.11.39.46) with Microsoft SMTP Server (TLS) id 15.0.775.38 via Mailbox
 Transport; Tue, 10 Feb 2015 13:54:32 -0200
Received: from SERVER.xxx.br (10.11.39.46) by SERVER.xxx.br
 (10.11.39.46) with Microsoft SMTP Server (TLS) id 15.0.775.38; Tue, 10 Feb
 2015 13:54:31 -0200
Received: from SERVER.xxx.br ([::1]) by SERVER.xxx.br ([::1]) with
 mapi id 15.00.0775.031; Tue, 10 Feb 2015 13:54:31 -0200
13:55:04 Not equal (conflict) property: 0x007D001F
13:55:04 Local modification: {15:54:43.0557  10/02/2015 [DD/MM/YYYY]}
13:55:04 Remote modification: {15:54:55.0776  10/02/2015 [DD/MM/YYYY]}
13:55:04 Conflict generated, remote item is winner

Our question is: do ESET assure that ESET's Outlook integration is compatible to MS Exchange automapped shared accounts?
We asked regional dealer and they assured compatibility for IMAP and POP3 accounts. No answer about the situation above.

What will be the impact over the network if ESET Integration is disabled?

Edited February 11, 2015 by Surfergirl