Exchange 2007 appending "Spam:" in thesubject field of all emails

Hi,
We are running Exchange 2007 and have come across an issue where nearly all our emails are being appended with "Spam:" in the subject field.

This started happening when we got back from out christmas holiday.  I did learn that the exchange server went down over the holiday period and someone came in and reset the server.  I'm wondering if this may have finished off installing an update of some sort and changed the settings.

I could not find any settings to change or even where to look whether it be in exchange management console or our anti-virus program, we are running Trend Micro Worry Free Business server edition.  I couldn't find any settings regarding filtering emails.

This "Spam:" notice is also happening to some of our internal emails and from people we send and receive emails to and from everyday.

Here is a copy of the header of one of the emails:

Received: from SERVER-SBS.synergy.local ([fe80::7d3c:eb01:8dde:c4a4]) by
 SERVER-SBS.synergy.local ([fe80::7d3c:eb01:8dde:c4a4%10]) with mapi; Mon, 7
 Jan 2013 11:41:59 +1000
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: Selena Beard <admin@synergysystems.com.au>
To:  Matt Byers <Matt@synergysystems.com.au>
Date: Mon, 7 Jan 2013 11:41:57 +1000
Subject: Spam: MINUTES 07/01/2013
Thread-Topic: MINUTES 07/01/2013
Thread-Index: Ac3seC2/mEe6RNbeRciRz/A3T3AvHw==
Message-ID: <010EEA728745C04392A54F5253898B480205B9C32509@SERVER-SBS.synergy.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <010EEA728745C04392A54F5253898B480205B9C32509@SERVER-SBS.synergy.local>
MIME-Version: 1.0
X-TM-AS-Product-Ver: SMEX-8.6.0.1374-7.000.1014-19022.003
X-TM-AS-Result: No-15.132900-8.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No

If you require any more information, I will be happy to provide.

Notice: I do have a lot of experience in computer systems but not a great deal in exchange servers.  I did notice the SCL is rated at -1 where i thought it could only be rated from 0-9?

Thank you,
Matt
mattyjbAsked:
Who is Participating?
 
Larry Struckmeyer MVPCommented:
X-TM-AS-Product-Ver: SMEX-8.6.0.1374-7.000.1014-19022.003
X-TM-AS-Result: No-15.132900-8.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No

Those lines are from Trend Micro.  It appears that either it is set to mark at too low a level, or the mail is being scanned by their "cloud" servers and giving too many false positives.  Since the message you posted is an internal message, or appears to be, it must be the SMEX scanner on the local exchange server.
0
 
Suliman Abu KharroubIT Consultant Commented:
I  saw such issues when GFI mail essentials was installed as an antispam and configured to append spam word in email subject...


Check GFI config ( if it is used as an antispam software, if not check the anispam is it is configured to do so).
0
 
mattyjbAuthor Commented:
Thank you for the reply,
We are not running GFI unfortunately, however I will have another look through the AntiSpam tab in exchange management console although the last couple of times I looked I could not find any settings or options relating to what to do with any emails that could 'possibly' be spam.

Thank you again.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
mattyjbAuthor Commented:
Thank you for that info, that has helped me a lot in what I am looking for.

For some reason I couldn't find ScanMail on the server although I did find the set up file for it.

I love taking over the Server after the usual person has left.

If there is anything else anyone can tell me about the above issue it would be greatly appreciated as the more information I get, the more understanding I can get on this sort of thing.
0
 
Larry Struckmeyer MVPCommented:
Compare the MX records of your public DNS records to the public IP of your local edge device... same or different?
0
 
mattyjbAuthor Commented:
I havent compared the public DNS record to the Public IP of the Local edge device as that went a little over my head.  

I did however notice the behavour with the emails where the 'Spam:' in the subject field is clearing up.  It seems to stop labeling it spam after 2 or 3 emails from the same person.  Like its trying to 're-learn' what the normal day to day or what the safe email addresses are.

If this sounds like a normal thing for an anti-spam program to do then I guess hooray for us!  Maybe something was reset in the new year and the antispam is learning it again, I have no idea, however it seems to be slowly clearing up.

Thank you for your insight, I did learn a little bit from you guys.

If you have anything to add to this comment about the behavour of the emails, please do as I would like your insight.  
If not, again thank you.
0
 
Larry Struckmeyer MVPCommented:
It does appear to me that my response suggesting the Trend Micro SMEX scanner was indeed the answer to the question.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.