Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 272
  • Last Modified:

Unreadable Message Content

Hi some of our exchange users are receiving email with unreadable information in all of a sudden, it is not happening to every one

example Below

CIP:81.218.47.225;CTRY:IL;IPV:NLI;EFV:NLI;SFV:NSPM;SFS:(10019001)(6009001)(51164003)(66544003)(85714005)(252514010)(377454003)(13464003)(501624003)(199002)(189002)(47976001)(65816001)(4396001)(76786001)(50986001)(44976005)(50466002)(76796001)(4610
      2001)(81816001)(51856001)(2656002)(80022001)(16601075003)(19580405001)(92566001)(87266001)(15974865002)(83322001)(23756003)(77982001)(59766001)(93136001)(6806004)(47736001)(85306002)(63696002)(74876001)(54316002)(20776003)(47776003)(15975445006)(7
      4706001)(53806001)(56776001)(54356001)(76482001)(80976001)(94946001)(19580395003)(94316002)(86362001)(85852003)(79102001)(74502001)(74662001)(56816005)(47446002)(31966008)(83072002)(81342001)(74366001)(33656001)(49866001)(87936001)(55846006)(69226
      001)(81686001)(92726001)(81542001)(90146001)(93516002)(15202345003)(95416001);DIR:OUT;SFP:1102;SCL:1;SRVR:DB3FFO11HUB052;H:N-EXCH.Novelsat.local;CLIP:81.218.47.225;FPR:;RD:mr1.novelsat.com;A:1;MX:1;LANG:en;
X-OriginatorOrg: novelsat.onmicrosoft.com
X-Forefront-PRVS: 0114FF88F6

can anyone explain why this is

John
0
pepps11976
Asked:
pepps11976
  • 11
  • 10
1 Solution
 
strivoliCommented:
Please post Exchange version and specify if it is fully patched. Thanks.
0
 
pepps11976Author Commented:
Its Exchange Server 2010 Version 8.3 Build 83.6
0
 
strivoliCommented:
The sender's IP should be 81.218.47.225. Based on www.mxtoolbox.com it is in one BlackList. The mail should come from ISRAEL.
It might be a malformed mail or it might use unreadable text (Hebrew) by the mail client.
If the user is unable to read the mail with a client such as Outlook (please post mail client version), try using OWA.
What happens when reading the mail with OWA?
0
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

 
pepps11976Author Commented:
Ok I will check via Webmail, So it is the Senders end then not our end

John
0
 
strivoliCommented:
Well, if that happens only with some mails I would think there's something wrong (or at least "unusual") with the sender.
You could take more mails with the same issue and compare the IP address. If they are all the same, then there's something wrong/unusual with that specific sender.
0
 
pepps11976Author Commented:
Ok Just had another one from a different domain

SFV:NSPM;SFS:(10009001)(377424004)(85714005)(66654002)(377454003)(501574003)(199002)(189002)(2656002)(63696002)(80022001)(66066001)(74502001)(74662001)(31966008)(47446002)(87266001)(16236675002)(65816001)(54316002)(33646001)(83322001)(79102001)(87
      936001)(19580395003)(19580405001)(80976001)(94316002)(85852003)(46102001)(94946001)(83072002)(95416001)(19300405004)(85306002)(53806001)(76786001)(76482001)(51856001)(54356001)(56816005)(50986001)(49866001)(76576001)(93136001)(17760045001)(4773600
      1)(69226001)(47976001)(90146001)(93516002)(81342001)(81542001)(19613025002)(19617315010)(92566001)(76796001)(4396001)(86362001)(74876001)(81686001)(74316001)(74366001)(15202345003)(15975445006)(74706001)(18206015023)(19609705001)(77982001)(5677600
      1)(16601075003)(59766001)(81816001)(95666003)(24736002);DIR:OUT;SFP:1101;SCL:1;SRVR:DM2PR06MB365;H:DM2PR06MB544.namprd06.prod.outlook.com;CLIP:66.80.42.15;FPR:FCCCFDC8.AC33571A.E7D55FF3.4CD7F84C.20326;PTR:InfoNoRecords;A:1;MX:3;LANG:en;
Content-Type: multipart/related;
      boundary="_004_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_";
      type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: empowerrf.com

--_004_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_
Content-Type: multipart/alternative;
      boundary="_000_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_"

--_000_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


can anything be picked out of that?

John
0
 
strivoliCommented:
Did you try to open previous mail with OWA (Webmail)?
0
 
pepps11976Author Commented:
Yes just checked it still shows the above
0
 
strivoliCommented:
Based on the mail's header your Exchange's AntiVirus (AV) should be Forefront. Please confirm.
Kindly post the AV's version.
0
 
pepps11976Author Commented:
Our Exchange AV is Symantec not forfront plus all our mail goes through Message Labs Mail scanner aswell

Could this be the recipients end
0
 
pepps11976Author Commented:
any more thoughts?
0
 
strivoliCommented:
You wrote you have "Exchange Server 2010 Version 8.3 Build 83.6" but that version doesn't belong to Exchange Server 2010. Either you have Exchange Server 2007 or the version you posted isn't correct.
I kindly ask you to check Exchange's version once again. Thank you.
Please, post Symantec version too as previously asked. Thank you.
0
 
pepps11976Author Commented:
Sorry you are correct it's exchange 2007 the antivirus I believe is 12.1 endpoint but I need to check that,
0
 
strivoliCommented:
Thanks for the feedback. When checking Exchange's version, please check the STORE.EXE version which is more accurate than the one shown using the Console.
0
 
pepps11976Author Commented:
Ok Anti Virus Version is Symantec 12.1.3001.165

I am unsure of how to get exchange version using store.exe though im afraid
0
 
strivoliCommented:
Find the file STORE.EXE, right-click and select Properties, move to the Details tab and read the value of "File version".
0
 
pepps11976Author Commented:
File Version 8.3.254.0
0
 
strivoliCommented:
It could be 8.3.264.0, not 8.3.254.0.
Please check and/or post a Screen Shot of the tab. Thank you.
0
 
pepps11976Author Commented:
store
0
 
strivoliCommented:
So, you have 2007 SP3 Update Rollup 6. The latest Rollup for 2007 SP3 is number 13. I suggest you to update your Exchange until reaching Rollup 13. Please let me know.
0
 
strivoliCommented:
I've taken my test Exchange 2007 SP3 and applied the Update Rollup 6 in order to get a system as similar as possible to yours.
I tried to apply Update Rollup 13 but it fails during setup. So I decided to follow Microsoft Update's directions and installed Update Rollup 12 and 8v2.
I suggest you apply the same (12 and 8v2) to yours.
0

Featured Post

Restore individual SQL databases with ease

Veeam Explorer for Microsoft SQL Server delivers an easy-to-use, wizard-driven interface for restoring your databases from a backup. No expert SQL background required. Web interface provides a complete view of all available SQL databases to simplify the recovery of lost database

  • 11
  • 10
Tackle projects and never again get stuck behind a technical roadblock.
Join Now