Solved

Exchange 2007 appending "Spam:" in thesubject field of all emails

Posted on 2013-01-08
9
79 Views
Last Modified: 2016-06-30
Hi,
We are running Exchange 2007 and have come across an issue where nearly all our emails are being appended with "Spam:" in the subject field.

This started happening when we got back from out christmas holiday.  I did learn that the exchange server went down over the holiday period and someone came in and reset the server.  I'm wondering if this may have finished off installing an update of some sort and changed the settings.

I could not find any settings to change or even where to look whether it be in exchange management console or our anti-virus program, we are running Trend Micro Worry Free Business server edition.  I couldn't find any settings regarding filtering emails.

This "Spam:" notice is also happening to some of our internal emails and from people we send and receive emails to and from everyday.

Here is a copy of the header of one of the emails:

Received: from SERVER-SBS.synergy.local ([fe80::7d3c:eb01:8dde:c4a4]) by
 SERVER-SBS.synergy.local ([fe80::7d3c:eb01:8dde:c4a4%10]) with mapi; Mon, 7
 Jan 2013 11:41:59 +1000
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: Selena Beard <admin@synergysystems.com.au>
To:  Matt Byers <Matt@synergysystems.com.au>
Date: Mon, 7 Jan 2013 11:41:57 +1000
Subject: Spam: MINUTES 07/01/2013
Thread-Topic: MINUTES 07/01/2013
Thread-Index: Ac3seC2/mEe6RNbeRciRz/A3T3AvHw==
Message-ID: <010EEA728745C04392A54F5253898B480205B9C32509@SERVER-SBS.synergy.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <010EEA728745C04392A54F5253898B480205B9C32509@SERVER-SBS.synergy.local>
MIME-Version: 1.0
X-TM-AS-Product-Ver: SMEX-8.6.0.1374-7.000.1014-19022.003
X-TM-AS-Result: No-15.132900-8.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No

If you require any more information, I will be happy to provide.

Notice: I do have a lot of experience in computer systems but not a great deal in exchange servers.  I did notice the SCL is rated at -1 where i thought it could only be rated from 0-9?

Thank you,
Matt
0
Comment
Question by:mattyjb
  • 3
  • 3
9 Comments
 
LVL 23

Expert Comment

by:Suliman Abu Kharroub
ID: 38757348
I  saw such issues when GFI mail essentials was installed as an antispam and configured to append spam word in email subject...


Check GFI config ( if it is used as an antispam software, if not check the anispam is it is configured to do so).
0
 

Author Comment

by:mattyjb
ID: 38757430
Thank you for the reply,
We are not running GFI unfortunately, however I will have another look through the AntiSpam tab in exchange management console although the last couple of times I looked I could not find any settings or options relating to what to do with any emails that could 'possibly' be spam.

Thank you again.
0
 
LVL 21

Accepted Solution

by:
Larry Struckmeyer MVP earned 500 total points
ID: 38757549
X-TM-AS-Product-Ver: SMEX-8.6.0.1374-7.000.1014-19022.003
X-TM-AS-Result: No-15.132900-8.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No

Those lines are from Trend Micro.  It appears that either it is set to mark at too low a level, or the mail is being scanned by their "cloud" servers and giving too many false positives.  Since the message you posted is an internal message, or appears to be, it must be the SMEX scanner on the local exchange server.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:mattyjb
ID: 38757842
Thank you for that info, that has helped me a lot in what I am looking for.

For some reason I couldn't find ScanMail on the server although I did find the set up file for it.

I love taking over the Server after the usual person has left.

If there is anything else anyone can tell me about the above issue it would be greatly appreciated as the more information I get, the more understanding I can get on this sort of thing.
0
 
LVL 21

Expert Comment

by:Larry Struckmeyer MVP
ID: 38758373
Compare the MX records of your public DNS records to the public IP of your local edge device... same or different?
0
 

Author Comment

by:mattyjb
ID: 38761474
I havent compared the public DNS record to the Public IP of the Local edge device as that went a little over my head.  

I did however notice the behavour with the emails where the 'Spam:' in the subject field is clearing up.  It seems to stop labeling it spam after 2 or 3 emails from the same person.  Like its trying to 're-learn' what the normal day to day or what the safe email addresses are.

If this sounds like a normal thing for an anti-spam program to do then I guess hooray for us!  Maybe something was reset in the new year and the antispam is learning it again, I have no idea, however it seems to be slowly clearing up.

Thank you for your insight, I did learn a little bit from you guys.

If you have anything to add to this comment about the behavour of the emails, please do as I would like your insight.  
If not, again thank you.
0
 
LVL 21

Expert Comment

by:Larry Struckmeyer MVP
ID: 41684140
It does appear to me that my response suggesting the Trend Micro SMEX scanner was indeed the answer to the question.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now