I have an issue here when the IronPort (AsyncOS, 8.5). scans emails from particular sender the folling error occurs and the attachment is stripped.
Message 129182579 scanned by Anti-Virus engine Sophos. Interim verdict: CLEAN
Message 129182579 scanned by Anti-Virus engine. Final verdict: Negative
Message 129182579 contains attachment 'DocumentName_10212014.pdf'.
Message 129182579: scanning error (name='DocumentName_10212014.pdf', type=document/pdf): file is corrupt
I don't believe the file is encrypted and the error only occurs for this one sender, with all attachments they send. They only send PDFs. We are able to receive PDFs from all other companies, however the client is able to send to other companies without their attachments being stripped.