Nova Consult ApS
asked on
strange email subject and mail content
Hello all
I have a exchange user that somtime recive a mail looking like this
subject: =?iso-8859-1?Q?Re:_offert_
and the email :
?=
=?iso-8859-1?Q?__A045?=
Message-ID: <OF1EFFxxxx.0110C7CE-ON002
From: =?iso-8859-1?Q?Markjjjus_B
Date: Tue, 23 Nov 2010 12:22:26 +0000
Content-Type: multipart/mixed;
boundary="=_mixed 0043F8F4C12577E4_="
References: <OFD22Dxxxx.5A4BCDD8-ON002
MIME-Version: 1.0
X-KeepSent: 1EFFA8C1:0110C7CE-002577E4
X-Mailer: Lotus Notes Release 8.5 December 05, 2008
X-Disclaimed: 38515
X-OriginatorOrg: xxx.xx
X-Proofpoint-SPF-Result: pass
X-Proofpoint-SPF-Record: v=spf1 include:spf.mail.xxx.xx -all
X-Proofpoint-Virus-Version
X-Proofpoint-Spam-Details:
Return-Path: <xxxx@xxx.xx>
X-OriginalArrivalTime: 23 Nov 2010 12:33:35.0354 (UTC) FILETIME=[A58BFDA0:01CB8B0
This is a multi-part message in MIME format.
--=_mixed 0043F8F4C12577E4_=
Content-Type: multipart/alternative;
boundary="=_alternative 0043F8F4C12577E4_="
--=_alternative 0043F8F4C12577E4_=
Content-Type: text/plain;
charset="ISO-8859-1"
Content-Transfer-Encoding:
<EMAIL>
--=_alternative 0043F8F4C12577E4_=--
--=_mixed 0043F8F4C12577E4_=
Content-Type: application/zip;
name="101119_A054_.zip"
Content-Disposition: attachment;
filename="101119_A054_.zip
Content-Transfer-Encoding:
UEsDBBQAAAAIANpodz2CbbFMxq
bnMuc3RsvF3JrmQ1DN0j8Q+9R5
ju04v/38w/ffvPv0ky8/++TdF1
MeReE30M7965mzt+vv0I/wMYPz
pa/6ON28f3yVl0JD+U9oaTUPqG
..................
Anyone that know why this is ??
I have a exchange user that somtime recive a mail looking like this
subject: =?iso-8859-1?Q?Re:_offert_
and the email :
?=
=?iso-8859-1?Q?__A045?=
Message-ID: <OF1EFFxxxx.0110C7CE-ON002
From: =?iso-8859-1?Q?Markjjjus_B
Date: Tue, 23 Nov 2010 12:22:26 +0000
Content-Type: multipart/mixed;
boundary="=_mixed 0043F8F4C12577E4_="
References: <OFD22Dxxxx.5A4BCDD8-ON002
MIME-Version: 1.0
X-KeepSent: 1EFFA8C1:0110C7CE-002577E4
X-Mailer: Lotus Notes Release 8.5 December 05, 2008
X-Disclaimed: 38515
X-OriginatorOrg: xxx.xx
X-Proofpoint-SPF-Result: pass
X-Proofpoint-SPF-Record: v=spf1 include:spf.mail.xxx.xx -all
X-Proofpoint-Virus-Version
X-Proofpoint-Spam-Details:
Return-Path: <xxxx@xxx.xx>
X-OriginalArrivalTime: 23 Nov 2010 12:33:35.0354 (UTC) FILETIME=[A58BFDA0:01CB8B0
This is a multi-part message in MIME format.
--=_mixed 0043F8F4C12577E4_=
Content-Type: multipart/alternative;
boundary="=_alternative 0043F8F4C12577E4_="
--=_alternative 0043F8F4C12577E4_=
Content-Type: text/plain;
charset="ISO-8859-1"
Content-Transfer-Encoding:
<EMAIL>
--=_alternative 0043F8F4C12577E4_=--
--=_mixed 0043F8F4C12577E4_=
Content-Type: application/zip;
name="101119_A054_.zip"
Content-Disposition: attachment;
filename="101119_A054_.zip
Content-Transfer-Encoding:
UEsDBBQAAAAIANpodz2CbbFMxq
bnMuc3RsvF3JrmQ1DN0j8Q+9R5
ju04v/38w/ffvPv0ky8/++TdF1
MeReE30M7965mzt+vv0I/wMYPz
pa/6ON28f3yVl0JD+U9oaTUPqG
..................
Anyone that know why this is ??
ASKER
oki but why does it show this in the email ??
Hello,
is your question about why he gets those mails or why they looks like that way?
You wrote exchange user. The X-Mailer tolds you that the sender uses a Lotus Notes client. If you have no Lotus Notes Client at your site, the mail maybe came from outside. But then your exchange is not configured proberly. You can check the domain from a sender of an email. If the domain is not valid you can drop such mails...
If the look of the email is the problem i have to follow saikapian. What you can see is the email header with the different informations about the email (sender, recipient, which server relayed the mail, sender domain, spam status, anti-virus checking informations and so on).
And this is a multipart message, that means that the email contains a "normal" body with information (text eg.), and has an attachment. If you look at the header information: "Content-Disposition" you can see that it is an ZIP-File attachment: "101119_A054_.zip".
But i still wonder about the domain where the email was derived (@LocalDomain). Or the server: "server01.xxx.local". Did you changed the header informations? If not, configure your exchange to check if sender domain or server domain is valid otherwise drop such mails...
Kindly Regards
is your question about why he gets those mails or why they looks like that way?
You wrote exchange user. The X-Mailer tolds you that the sender uses a Lotus Notes client. If you have no Lotus Notes Client at your site, the mail maybe came from outside. But then your exchange is not configured proberly. You can check the domain from a sender of an email. If the domain is not valid you can drop such mails...
If the look of the email is the problem i have to follow saikapian. What you can see is the email header with the different informations about the email (sender, recipient, which server relayed the mail, sender domain, spam status, anti-virus checking informations and so on).
And this is a multipart message, that means that the email contains a "normal" body with information (text eg.), and has an attachment. If you look at the header information: "Content-Disposition" you can see that it is an ZIP-File attachment: "101119_A054_.zip".
But i still wonder about the domain where the email was derived (@LocalDomain). Or the server: "server01.xxx.local". Did you changed the header informations? If not, configure your exchange to check if sender domain or server domain is valid otherwise drop such mails...
Kindly Regards
How is it originally being sent?
Is it coming from a script that might be getting it wrong? Only to one specific user? From one specific user? If the same mail is sent to another user does the same thing happen?
Is it from an internal or external source? Do you have any antispam filtering that might be doing it? I see FSecure mentioned in there.
Is it coming from a script that might be getting it wrong? Only to one specific user? From one specific user? If the same mail is sent to another user does the same thing happen?
Is it from an internal or external source? Do you have any antispam filtering that might be doing it? I see FSecure mentioned in there.
What are the Exchange and/or Outlook releases used by the recipient? And how are other character sets enabled in your server? IMHO the server only needs to recognise the switch to a different character set initiated by =?iso-8859-1?Q?
ASKER
in the inbox the user see his subject: =?iso-8859-1?Q?Re:_offert_
and the text part of the email is shown like the in my first post
i have changed som thing in the txt so it is not the original txt
i have a f-secure spam msg box in front of the customers exchange server
this email come for another company
dont know what else you need ?
and the text part of the email is shown like the in my first post
i have changed som thing in the txt so it is not the original txt
i have a f-secure spam msg box in front of the customers exchange server
this email come for another company
dont know what else you need ?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
hmm
This is NOT the actual email it is EMAIL HEADER content. All these things mentioned there are part o a email header like
X MAILER tells the email client from where the email was sent.
Message ID is the smtp id of the email which uniquely represents a mail over internet.
So don't panic its not like a virus code or something like that, its just the email header. You will be able to make out the all the info regarding the email from the email header but not the actual email content i.e. teh BODY part of the email because it is encrypted in the MIME format.
Thanks !!