Any anti virus add-on is suspect. Remove it if you can.

I would suggest you have a look at the signatures used. recently spam filter appear to be flagging mail with images in the signature. especially if the signature results in the last thing in the email being an image.

Hi Matt

Thank you for your help.

Yes I have been loathe to turn off the anti virus completely as this is a law firm office with sensitive data. However I am inclined to agree that this is a likely cause of the problem as most other things are eliminated. So on Sunday when the office is empty I will do everything I can to protect a machine, then turn off the anti-virus. I will report back here.

As to the signature, there is no image in it and also I have checked the spam boxes on some recipients and the emails are not there, but good to know about the signatures.

Joe

Seriously, lets look at mail scanning by anti virus products.

When you get mail that apparently need to either hack your system or stick usually unreliable bits of code into your mail program. But why? that is the serious question most folk do not know to ask.

An email is a text file. you can open it in notepad and look at all the gory guts. You can not execute it, access an attachment or do much more that read the HTML source code that comprises the body of the email. Binary attachments appear a mime encoded text as well.

If you or anyone else can suggest how having that text file makes your system any less secure I am all ears. It is only what is done with that file that can cause trouble.

Thunderbird has an option in Options > Security > Anti virus to allow anti virus programs to scan incoming mail. The process works by Thunderbird writing the email to the temp folder before it incorporates it as received in the main mail folders.

If your anti virus is not capable of scanning files that come into your computer in that manner, it is in fact not worth having. and you probably already have a virus. Why would Thunderbird offer a process like this? To keep itself free of the rogue code that anti virus products inject that is of questionable quality and even more questionable reliability.

So there is absolutely no point having an anti virus scanning incoming mail. The sorts of anti virus products we had using windows 3 that scanned floppy disks and watched new files and scanned them were capable of working with Thunderbird email scanning options.

Then we see these other apparently wonderful capabilities this code introduces; SPAM filtering. Thunderbird has a fairly intelligent spam engine that does a good job of learning what you consider spam, as long as the email address is not your trigger. If it is not to your liking, there are add-ons from others that make it their job to specialize in spam. Letting an anti virus into that space is questionable at best. That is not one of their core functions and I wonder why they are there at all. Scam protection, what an admirable idea. But given all the trouble occurs in the browser, really scam detection in not all that relevant to an email client. If the product is doing it's job it will take appropriate actions in the browser.

The exception to this rule is RSS feeds in Thunderbird as they are a browser activity. But I would seriously question reading RSS feeds in your email client of you have sensitive information to protect. Just as most businesses encourage staff to keep their personal devices off the local network, offering guess access for security reasons, placing your web browsing and email together represents a small risk of it's own that is unacceptable in a secure environment.

Outgoing mail scanning is I feel the biggest con in th world. What are they scanning for? The virus they could not find on your system? Malware does not just spontaneously appear, but these products are scanning for something on as device they have already scanned and certified as clean. When the Anti virus folk are challenged they fall back to "another line of defense". It is a bit late to catch the bomber when they are leaving the country!

IF you care to send me an email at [email protected] with some of these non delivery signatures, I would be happy to look at the source and see if I can find anything.

Hi Matt Sorry to be so long in replying - was away from my computer and dropped my phone.

Thanks again for your help and your notes on email anti-virus - ther was a lot in there which I have never thought too much about

Thank you very much too for offering to have a look at some failed emails - I will send some shortly.

I am about to experiment with turning off anti-virus and will let you know shortly.

Kind Regards

Joe