Link to home
Start Free TrialLog in
Avatar of pepps11976
pepps11976

asked on

Unreadable Message Content

Hi some of our exchange users are receiving email with unreadable information in all of a sudden, it is not happening to every one

example Below

CIP:81.218.47.225;CTRY:IL;IPV:NLI;EFV:NLI;SFV:NSPM;SFS:(10019001)(6009001)(51164003)(66544003)(85714005)(252514010)(377454003)(13464003)(501624003)(199002)(189002)(47976001)(65816001)(4396001)(76786001)(50986001)(44976005)(50466002)(76796001)(4610
      2001)(81816001)(51856001)(2656002)(80022001)(16601075003)(19580405001)(92566001)(87266001)(15974865002)(83322001)(23756003)(77982001)(59766001)(93136001)(6806004)(47736001)(85306002)(63696002)(74876001)(54316002)(20776003)(47776003)(15975445006)(7
      4706001)(53806001)(56776001)(54356001)(76482001)(80976001)(94946001)(19580395003)(94316002)(86362001)(85852003)(79102001)(74502001)(74662001)(56816005)(47446002)(31966008)(83072002)(81342001)(74366001)(33656001)(49866001)(87936001)(55846006)(69226
      001)(81686001)(92726001)(81542001)(90146001)(93516002)(15202345003)(95416001);DIR:OUT;SFP:1102;SCL:1;SRVR:DB3FFO11HUB052;H:N-EXCH.Novelsat.local;CLIP:81.218.47.225;FPR:;RD:mr1.novelsat.com;A:1;MX:1;LANG:en;
X-OriginatorOrg: novelsat.onmicrosoft.com
X-Forefront-PRVS: 0114FF88F6

can anyone explain why this is

John
Avatar of strivoli
strivoli
Flag of Italy image

Please post Exchange version and specify if it is fully patched. Thanks.
Avatar of pepps11976
pepps11976

ASKER

Its Exchange Server 2010 Version 8.3 Build 83.6
The sender's IP should be 81.218.47.225. Based on www.mxtoolbox.com it is in one BlackList. The mail should come from ISRAEL.
It might be a malformed mail or it might use unreadable text (Hebrew) by the mail client.
If the user is unable to read the mail with a client such as Outlook (please post mail client version), try using OWA.
What happens when reading the mail with OWA?
Ok I will check via Webmail, So it is the Senders end then not our end

John
Well, if that happens only with some mails I would think there's something wrong (or at least "unusual") with the sender.
You could take more mails with the same issue and compare the IP address. If they are all the same, then there's something wrong/unusual with that specific sender.
Ok Just had another one from a different domain

SFV:NSPM;SFS:(10009001)(377424004)(85714005)(66654002)(377454003)(501574003)(199002)(189002)(2656002)(63696002)(80022001)(66066001)(74502001)(74662001)(31966008)(47446002)(87266001)(16236675002)(65816001)(54316002)(33646001)(83322001)(79102001)(87
      936001)(19580395003)(19580405001)(80976001)(94316002)(85852003)(46102001)(94946001)(83072002)(95416001)(19300405004)(85306002)(53806001)(76786001)(76482001)(51856001)(54356001)(56816005)(50986001)(49866001)(76576001)(93136001)(17760045001)(4773600
      1)(69226001)(47976001)(90146001)(93516002)(81342001)(81542001)(19613025002)(19617315010)(92566001)(76796001)(4396001)(86362001)(74876001)(81686001)(74316001)(74366001)(15202345003)(15975445006)(74706001)(18206015023)(19609705001)(77982001)(5677600
      1)(16601075003)(59766001)(81816001)(95666003)(24736002);DIR:OUT;SFP:1101;SCL:1;SRVR:DM2PR06MB365;H:DM2PR06MB544.namprd06.prod.outlook.com;CLIP:66.80.42.15;FPR:FCCCFDC8.AC33571A.E7D55FF3.4CD7F84C.20326;PTR:InfoNoRecords;A:1;MX:3;LANG:en;
Content-Type: multipart/related;
      boundary="_004_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_";
      type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: empowerrf.com

--_004_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_
Content-Type: multipart/alternative;
      boundary="_000_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_"

--_000_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


can anything be picked out of that?

John
Did you try to open previous mail with OWA (Webmail)?
Yes just checked it still shows the above
Based on the mail's header your Exchange's AntiVirus (AV) should be Forefront. Please confirm.
Kindly post the AV's version.
Our Exchange AV is Symantec not forfront plus all our mail goes through Message Labs Mail scanner aswell

Could this be the recipients end
any more thoughts?
You wrote you have "Exchange Server 2010 Version 8.3 Build 83.6" but that version doesn't belong to Exchange Server 2010. Either you have Exchange Server 2007 or the version you posted isn't correct.
I kindly ask you to check Exchange's version once again. Thank you.
Please, post Symantec version too as previously asked. Thank you.
Sorry you are correct it's exchange 2007 the antivirus I believe is 12.1 endpoint but I need to check that,
Thanks for the feedback. When checking Exchange's version, please check the STORE.EXE version which is more accurate than the one shown using the Console.
Ok Anti Virus Version is Symantec 12.1.3001.165

I am unsure of how to get exchange version using store.exe though im afraid
Find the file STORE.EXE, right-click and select Properties, move to the Details tab and read the value of "File version".
File Version 8.3.254.0
It could be 8.3.264.0, not 8.3.254.0.
Please check and/or post a Screen Shot of the tab. Thank you.
So, you have 2007 SP3 Update Rollup 6. The latest Rollup for 2007 SP3 is number 13. I suggest you to update your Exchange until reaching Rollup 13. Please let me know.
ASKER CERTIFIED SOLUTION
Avatar of strivoli
strivoli
Flag of Italy image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial