Solved

Unreadable Message Content

Posted on 2014-02-25
21
252 Views
Last Modified: 2014-03-14
Hi some of our exchange users are receiving email with unreadable information in all of a sudden, it is not happening to every one

example Below

CIP:81.218.47.225;CTRY:IL;IPV:NLI;EFV:NLI;SFV:NSPM;SFS:(10019001)(6009001)(51164003)(66544003)(85714005)(252514010)(377454003)(13464003)(501624003)(199002)(189002)(47976001)(65816001)(4396001)(76786001)(50986001)(44976005)(50466002)(76796001)(4610
      2001)(81816001)(51856001)(2656002)(80022001)(16601075003)(19580405001)(92566001)(87266001)(15974865002)(83322001)(23756003)(77982001)(59766001)(93136001)(6806004)(47736001)(85306002)(63696002)(74876001)(54316002)(20776003)(47776003)(15975445006)(7
      4706001)(53806001)(56776001)(54356001)(76482001)(80976001)(94946001)(19580395003)(94316002)(86362001)(85852003)(79102001)(74502001)(74662001)(56816005)(47446002)(31966008)(83072002)(81342001)(74366001)(33656001)(49866001)(87936001)(55846006)(69226
      001)(81686001)(92726001)(81542001)(90146001)(93516002)(15202345003)(95416001);DIR:OUT;SFP:1102;SCL:1;SRVR:DB3FFO11HUB052;H:N-EXCH.Novelsat.local;CLIP:81.218.47.225;FPR:;RD:mr1.novelsat.com;A:1;MX:1;LANG:en;
X-OriginatorOrg: novelsat.onmicrosoft.com
X-Forefront-PRVS: 0114FF88F6

can anyone explain why this is

John
0
Comment
Question by:pepps11976
  • 11
  • 10
21 Comments
 
LVL 19

Expert Comment

by:strivoli
ID: 39885149
Please post Exchange version and specify if it is fully patched. Thanks.
0
 

Author Comment

by:pepps11976
ID: 39885154
Its Exchange Server 2010 Version 8.3 Build 83.6
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39885190
The sender's IP should be 81.218.47.225. Based on www.mxtoolbox.com it is in one BlackList. The mail should come from ISRAEL.
It might be a malformed mail or it might use unreadable text (Hebrew) by the mail client.
If the user is unable to read the mail with a client such as Outlook (please post mail client version), try using OWA.
What happens when reading the mail with OWA?
0
 

Author Comment

by:pepps11976
ID: 39885196
Ok I will check via Webmail, So it is the Senders end then not our end

John
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39885200
Well, if that happens only with some mails I would think there's something wrong (or at least "unusual") with the sender.
You could take more mails with the same issue and compare the IP address. If they are all the same, then there's something wrong/unusual with that specific sender.
0
 

Author Comment

by:pepps11976
ID: 39888214
Ok Just had another one from a different domain

SFV:NSPM;SFS:(10009001)(377424004)(85714005)(66654002)(377454003)(501574003)(199002)(189002)(2656002)(63696002)(80022001)(66066001)(74502001)(74662001)(31966008)(47446002)(87266001)(16236675002)(65816001)(54316002)(33646001)(83322001)(79102001)(87
      936001)(19580395003)(19580405001)(80976001)(94316002)(85852003)(46102001)(94946001)(83072002)(95416001)(19300405004)(85306002)(53806001)(76786001)(76482001)(51856001)(54356001)(56816005)(50986001)(49866001)(76576001)(93136001)(17760045001)(4773600
      1)(69226001)(47976001)(90146001)(93516002)(81342001)(81542001)(19613025002)(19617315010)(92566001)(76796001)(4396001)(86362001)(74876001)(81686001)(74316001)(74366001)(15202345003)(15975445006)(74706001)(18206015023)(19609705001)(77982001)(5677600
      1)(16601075003)(59766001)(81816001)(95666003)(24736002);DIR:OUT;SFP:1101;SCL:1;SRVR:DM2PR06MB365;H:DM2PR06MB544.namprd06.prod.outlook.com;CLIP:66.80.42.15;FPR:FCCCFDC8.AC33571A.E7D55FF3.4CD7F84C.20326;PTR:InfoNoRecords;A:1;MX:3;LANG:en;
Content-Type: multipart/related;
      boundary="_004_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_";
      type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: empowerrf.com

--_004_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_
Content-Type: multipart/alternative;
      boundary="_000_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_"

--_000_4416e30b6355484994e27227fb9e3ed0DM2PR06MB544namprd06pro_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


can anything be picked out of that?

John
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39888304
Did you try to open previous mail with OWA (Webmail)?
0
 

Author Comment

by:pepps11976
ID: 39888397
Yes just checked it still shows the above
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39888411
Based on the mail's header your Exchange's AntiVirus (AV) should be Forefront. Please confirm.
Kindly post the AV's version.
0
 

Author Comment

by:pepps11976
ID: 39888468
Our Exchange AV is Symantec not forfront plus all our mail goes through Message Labs Mail scanner aswell

Could this be the recipients end
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:pepps11976
ID: 39889401
any more thoughts?
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39889720
You wrote you have "Exchange Server 2010 Version 8.3 Build 83.6" but that version doesn't belong to Exchange Server 2010. Either you have Exchange Server 2007 or the version you posted isn't correct.
I kindly ask you to check Exchange's version once again. Thank you.
Please, post Symantec version too as previously asked. Thank you.
0
 

Author Comment

by:pepps11976
ID: 39889767
Sorry you are correct it's exchange 2007 the antivirus I believe is 12.1 endpoint but I need to check that,
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39890247
Thanks for the feedback. When checking Exchange's version, please check the STORE.EXE version which is more accurate than the one shown using the Console.
0
 

Author Comment

by:pepps11976
ID: 39891574
Ok Anti Virus Version is Symantec 12.1.3001.165

I am unsure of how to get exchange version using store.exe though im afraid
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39891618
Find the file STORE.EXE, right-click and select Properties, move to the Details tab and read the value of "File version".
0
 

Author Comment

by:pepps11976
ID: 39891648
File Version 8.3.254.0
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39891697
It could be 8.3.264.0, not 8.3.254.0.
Please check and/or post a Screen Shot of the tab. Thank you.
0
 

Author Comment

by:pepps11976
ID: 39891835
store
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39892559
So, you have 2007 SP3 Update Rollup 6. The latest Rollup for 2007 SP3 is number 13. I suggest you to update your Exchange until reaching Rollup 13. Please let me know.
0
 
LVL 19

Accepted Solution

by:
strivoli earned 500 total points
ID: 39894995
I've taken my test Exchange 2007 SP3 and applied the Update Rollup 6 in order to get a system as similar as possible to yours.
I tried to apply Update Rollup 13 but it fails during setup. So I decided to follow Microsoft Update's directions and installed Update Rollup 12 and 8v2.
I suggest you apply the same (12 and 8v2) to yours.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Check out this infographic on what you need to make a good email signature that will work perfectly for your organization.
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now