Solved

Exchange 2007 appending "Spam:" in thesubject field of all emails

Posted on 2013-01-08
9
111 Views
Last Modified: 2016-06-30
Hi,
We are running Exchange 2007 and have come across an issue where nearly all our emails are being appended with "Spam:" in the subject field.

This started happening when we got back from out christmas holiday.  I did learn that the exchange server went down over the holiday period and someone came in and reset the server.  I'm wondering if this may have finished off installing an update of some sort and changed the settings.

I could not find any settings to change or even where to look whether it be in exchange management console or our anti-virus program, we are running Trend Micro Worry Free Business server edition.  I couldn't find any settings regarding filtering emails.

This "Spam:" notice is also happening to some of our internal emails and from people we send and receive emails to and from everyday.

Here is a copy of the header of one of the emails:

Received: from SERVER-SBS.synergy.local ([fe80::7d3c:eb01:8dde:c4a4]) by
 SERVER-SBS.synergy.local ([fe80::7d3c:eb01:8dde:c4a4%10]) with mapi; Mon, 7
 Jan 2013 11:41:59 +1000
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: Selena Beard <admin@synergysystems.com.au>
To:  Matt Byers <Matt@synergysystems.com.au>
Date: Mon, 7 Jan 2013 11:41:57 +1000
Subject: Spam: MINUTES 07/01/2013
Thread-Topic: MINUTES 07/01/2013
Thread-Index: Ac3seC2/mEe6RNbeRciRz/A3T3AvHw==
Message-ID: <010EEA728745C04392A54F5253898B480205B9C32509@SERVER-SBS.synergy.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <010EEA728745C04392A54F5253898B480205B9C32509@SERVER-SBS.synergy.local>
MIME-Version: 1.0
X-TM-AS-Product-Ver: SMEX-8.6.0.1374-7.000.1014-19022.003
X-TM-AS-Result: No-15.132900-8.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No

If you require any more information, I will be happy to provide.

Notice: I do have a lot of experience in computer systems but not a great deal in exchange servers.  I did notice the SCL is rated at -1 where i thought it could only be rated from 0-9?

Thank you,
Matt
0
Comment
Question by:mattyjb
  • 3
  • 3
9 Comments
 
LVL 23

Expert Comment

by:Suliman Abu Kharroub
ID: 38757348
I  saw such issues when GFI mail essentials was installed as an antispam and configured to append spam word in email subject...


Check GFI config ( if it is used as an antispam software, if not check the anispam is it is configured to do so).
0
 

Author Comment

by:mattyjb
ID: 38757430
Thank you for the reply,
We are not running GFI unfortunately, however I will have another look through the AntiSpam tab in exchange management console although the last couple of times I looked I could not find any settings or options relating to what to do with any emails that could 'possibly' be spam.

Thank you again.
0
 
LVL 22

Accepted Solution

by:
Larry Struckmeyer MVP earned 500 total points
ID: 38757549
X-TM-AS-Product-Ver: SMEX-8.6.0.1374-7.000.1014-19022.003
X-TM-AS-Result: No-15.132900-8.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No

Those lines are from Trend Micro.  It appears that either it is set to mark at too low a level, or the mail is being scanned by their "cloud" servers and giving too many false positives.  Since the message you posted is an internal message, or appears to be, it must be the SMEX scanner on the local exchange server.
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 

Author Comment

by:mattyjb
ID: 38757842
Thank you for that info, that has helped me a lot in what I am looking for.

For some reason I couldn't find ScanMail on the server although I did find the set up file for it.

I love taking over the Server after the usual person has left.

If there is anything else anyone can tell me about the above issue it would be greatly appreciated as the more information I get, the more understanding I can get on this sort of thing.
0
 
LVL 22

Expert Comment

by:Larry Struckmeyer MVP
ID: 38758373
Compare the MX records of your public DNS records to the public IP of your local edge device... same or different?
0
 

Author Comment

by:mattyjb
ID: 38761474
I havent compared the public DNS record to the Public IP of the Local edge device as that went a little over my head.  

I did however notice the behavour with the emails where the 'Spam:' in the subject field is clearing up.  It seems to stop labeling it spam after 2 or 3 emails from the same person.  Like its trying to 're-learn' what the normal day to day or what the safe email addresses are.

If this sounds like a normal thing for an anti-spam program to do then I guess hooray for us!  Maybe something was reset in the new year and the antispam is learning it again, I have no idea, however it seems to be slowly clearing up.

Thank you for your insight, I did learn a little bit from you guys.

If you have anything to add to this comment about the behavour of the emails, please do as I would like your insight.  
If not, again thank you.
0
 
LVL 22

Expert Comment

by:Larry Struckmeyer MVP
ID: 41684140
It does appear to me that my response suggesting the Trend Micro SMEX scanner was indeed the answer to the question.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
exchange, squid, proxy, linux 6 45
exchange, office 365 13 37
Restored mailboxes and OST 11 40
Round robin for Exchange 2013 4 27
Utilizing an array to gracefully append to a list of EmailAddresses
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question