pepps11976
asked on
Unreadable Message Content
Hi some of our exchange users are receiving email with unreadable information in all of a sudden, it is not happening to every one
example Below
CIP:81.218.47.225;CTRY:IL; IPV:NLI;EF V:NLI;SFV: NSPM;SFS:( 10019001)( 6009001)(5 1164003)(6 6544003)(8 5714005)(2 52514010)( 377454003) (13464003) (501624003 )(199002)( 189002)(47 976001)(65 816001)(43 96001)(767 86001)(509 86001)(449 76005)(504 66002)(767 96001)(461 0
2001)(81816001)(51856001)( 2656002)(8 0022001)(1 6601075003 )(19580405 001)(92566 001)(87266 001)(15974 865002)(83 322001)(23 756003)(77 982001)(59 766001)(93 136001)(68 06004)(477 36001)(853 06002)(636 96002)(748 76001)(543 16002)(207 76003)(477 76003)(159 75445006)( 7
4706001)(53806001)(5677600 1)(5435600 1)(7648200 1)(8097600 1)(9494600 1)(1958039 5003)(9431 6002)(8636 2001)(8585 2003)(7910 2001)(7450 2001)(7466 2001)(5681 6005)(4744 6002)(3196 6008)(8307 2002)(8134 2001)(7436 6001)(3365 6001)(4986 6001)(8793 6001)(5584 6006)(6922 6
001)(81686001)(92726001)(8 1542001)(9 0146001)(9 3516002)(1 5202345003 )(95416001 );DIR:OUT; SFP:1102;S CL:1;SRVR: DB3FFO11HU B052;H:N-E XCH.Novels at.local;C LIP:81.218 .47.225;FP R:;RD:mr1. novelsat.c om;A:1;MX: 1;LANG:en;
X-OriginatorOrg: novelsat.onmicrosoft.com
X-Forefront-PRVS: 0114FF88F6
can anyone explain why this is
John
example Below
CIP:81.218.47.225;CTRY:IL;
2001)(81816001)(51856001)(
4706001)(53806001)(5677600
001)(81686001)(92726001)(8
X-OriginatorOrg: novelsat.onmicrosoft.com
X-Forefront-PRVS: 0114FF88F6
can anyone explain why this is
John
Please post Exchange version and specify if it is fully patched. Thanks.
ASKER
Its Exchange Server 2010 Version 8.3 Build 83.6
The sender's IP should be 81.218.47.225. Based on www.mxtoolbox.com it is in one BlackList. The mail should come from ISRAEL.
It might be a malformed mail or it might use unreadable text (Hebrew) by the mail client.
If the user is unable to read the mail with a client such as Outlook (please post mail client version), try using OWA.
What happens when reading the mail with OWA?
It might be a malformed mail or it might use unreadable text (Hebrew) by the mail client.
If the user is unable to read the mail with a client such as Outlook (please post mail client version), try using OWA.
What happens when reading the mail with OWA?
ASKER
Ok I will check via Webmail, So it is the Senders end then not our end
John
John
Well, if that happens only with some mails I would think there's something wrong (or at least "unusual") with the sender.
You could take more mails with the same issue and compare the IP address. If they are all the same, then there's something wrong/unusual with that specific sender.
You could take more mails with the same issue and compare the IP address. If they are all the same, then there's something wrong/unusual with that specific sender.
ASKER
Ok Just had another one from a different domain
SFV:NSPM;SFS:(10009001)(37 7424004)(8 5714005)(6 6654002)(3 77454003)( 501574003) (199002)(1 89002)(265 6002)(6369 6002)(8002 2001)(6606 6001)(7450 2001)(7466 2001)(3196 6008)(4744 6002)(8726 6001)(1623 6675002)(6 5816001)(5 4316002)(3 3646001)(8 3322001)(7 9102001)(8 7
936001)(19580395003)(19580 405001)(80 976001)(94 316002)(85 852003)(46 102001)(94 946001)(83 072002)(95 416001)(19 300405004) (85306002) (53806001) (76786001) (76482001) (51856001) (54356001) (56816005) (50986001) (49866001) (76576001) (93136001) (177600450 01)(477360 0
1)(69226001)(47976001)(901 46001)(935 16002)(813 42001)(815 42001)(196 13025002)( 1961731501 0)(9256600 1)(7679600 1)(4396001 )(86362001 )(74876001 )(81686001 )(74316001 )(74366001 )(15202345 003)(15975 445006)(74 706001)(18 206015023) (196097050 01)(779820 01)(567760 0
1)(16601075003)(59766001)( 81816001)( 95666003)( 24736002); DIR:OUT;SF P:1101;SCL :1;SRVR:DM 2PR06MB365 ;H:DM2PR06 MB544.namp rd06.prod. outlook.co m;CLIP:66. 80.42.15;F PR:FCCCFDC 8.AC33571A .E7D55FF3. 4CD7F84C.2 0326;PTR:I nfoNoRecor ds;A:1;MX: 3;LANG:en;
Content-Type: multipart/related;
boundary="_004_4416e30b635 5484994e27 227fb9e3ed 0DM2PR06MB 544namprd0 6pro_";
type="multipart/alternativ e"
MIME-Version: 1.0
X-OriginatorOrg: empowerrf.com
--_004_4416e30b6355484994e 27227fb9e3 ed0DM2PR06 MB544nampr d06pro_
Content-Type: multipart/alternative;
boundary="_000_4416e30b635 5484994e27 227fb9e3ed 0DM2PR06MB 544namprd0 6pro_"
--_000_4416e30b6355484994e 27227fb9e3 ed0DM2PR06 MB544nampr d06pro_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
can anything be picked out of that?
John
SFV:NSPM;SFS:(10009001)(37
936001)(19580395003)(19580
1)(69226001)(47976001)(901
1)(16601075003)(59766001)(
Content-Type: multipart/related;
boundary="_004_4416e30b635
type="multipart/alternativ
MIME-Version: 1.0
X-OriginatorOrg: empowerrf.com
--_004_4416e30b6355484994e
Content-Type: multipart/alternative;
boundary="_000_4416e30b635
--_000_4416e30b6355484994e
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding:
can anything be picked out of that?
John
Did you try to open previous mail with OWA (Webmail)?
ASKER
Yes just checked it still shows the above
Based on the mail's header your Exchange's AntiVirus (AV) should be Forefront. Please confirm.
Kindly post the AV's version.
Kindly post the AV's version.
ASKER
Our Exchange AV is Symantec not forfront plus all our mail goes through Message Labs Mail scanner aswell
Could this be the recipients end
Could this be the recipients end
ASKER
any more thoughts?
You wrote you have "Exchange Server 2010 Version 8.3 Build 83.6" but that version doesn't belong to Exchange Server 2010. Either you have Exchange Server 2007 or the version you posted isn't correct.
I kindly ask you to check Exchange's version once again. Thank you.
Please, post Symantec version too as previously asked. Thank you.
I kindly ask you to check Exchange's version once again. Thank you.
Please, post Symantec version too as previously asked. Thank you.
ASKER
Sorry you are correct it's exchange 2007 the antivirus I believe is 12.1 endpoint but I need to check that,
Thanks for the feedback. When checking Exchange's version, please check the STORE.EXE version which is more accurate than the one shown using the Console.
ASKER
Ok Anti Virus Version is Symantec 12.1.3001.165
I am unsure of how to get exchange version using store.exe though im afraid
I am unsure of how to get exchange version using store.exe though im afraid
Find the file STORE.EXE, right-click and select Properties, move to the Details tab and read the value of "File version".
ASKER
File Version 8.3.254.0
It could be 8.3.264.0, not 8.3.254.0.
Please check and/or post a Screen Shot of the tab. Thank you.
Please check and/or post a Screen Shot of the tab. Thank you.
So, you have 2007 SP3 Update Rollup 6. The latest Rollup for 2007 SP3 is number 13. I suggest you to update your Exchange until reaching Rollup 13. Please let me know.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.