Receiving emails with code in message

[Daveyd123]

I have a couple of users that when they receive email from a specific sender, the headers and other information is automatically inserted in the email.

Here is an email that came in:

error (smtp07.embarq.synacor.com: 1.2.3.4 is neither permitted nor denied by domain of xxxxx.com
Received: from [1.2.3.4] ([76.1.37.53:19402] helo=[192.168.2.101])
by mailrelay.embarq.synacor.com (envelope-from <aaa@xxx.com>)
(ecelerity 2.2.1.21 r(19176)) with ESMTPSA (cipher=AES256-SHA)
id 69/5B-29191-36F9C374; Thu, 15 Nov 2007 14:35:01 -0500
Message-ID: <473C9F62.9050601@xxxxxx.com
Disposition-Notification-To: BMH <aaa@xxxxxx.com>
Date: Thu, 15 Nov 2007 14:34:58 -0500
From: BMH <aaa@xxxxxxx.com>
Organization: xxxxxxxxxx.
User-Agent: Thunderbird 2.0.0.9 (Windows/20071031)
MIME-Version: 1.0
To: user@anotherdomain.com
Subject: Engineering Letter
Content-Type: multipart/mixed;
boundary="------------080703020809040806030203"
X-SEF-7853D99-ADF1-478E-8894-213D316B8FFA: 1
X-SEF-ZeroHour-RefID: vtr=0001.0A090207.473C9DC5.0106,vl=0,fgs=0
X-SEF-Processed: 6_0_0_39__2007_11_15_14_35_02

This is a multi-part message in MIME format.
--------------080703020809040806030203
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit


Then the actual message of the email


And when receiving an email with an attachment from that sender, there is no attachment just code.

-------------080703020809040806030203
Content-Type: application/pdf;
name="Document.pdf"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
filename="Document.pdf"

JVBERi0xLjQNCiXi48/TDQo5IDAgb2JqDQo8PA0KL0xpbmVhcml6ZWQgMQ0KL0wgNTcxNjMg
ICAgIA0KL0ggWyA2ODcgMjExICAgICAgICAgICAgICBdDQovTyAxMQ0KL0UgNTIyOTMgICAg
IA0KL04gMg0KL1QgNTY4NjAgICAgIA0KPj4NCmVuZG9iag0KeHJlZg0KOSAxNA0KMDAwMDAw
MDAxNyAwMDAwMCBuDQowMDAwMDAwNjA1IDAwMDAwIG4NCjAwMDAwMDA4OTggMDAwMDAgbg0K
MDAwMDAwMTE2MCAwMDAwMCBuDQowMDAwMDA0OTAxIDAwMDAwIG4NCjAwMDAwMzA1MDAgMDAw
MDAgbg0KMDAwMDAzMDY5OSAwMDAwMCBuDQowMDAwMDMxNjUwIDAwMDAwIG4NCjAwMDAwMzIx
NDMgMDAwMDAgbg0KMDAwMDA0NTk2MSAwMDAwMCBuDQowMDAwMDQ2MTY2IDAwMDAwIG4NCjAw
MDAwNDcxMjMgMDAwMDAgbg0KMDAwMDA0NzUzNCAwMDAwMCBuDQowMDAwMDAwNjg3IDAwMDAw



It ONLY happens from that sender. Emails with or without attachments from other senders come through fine

 

[Daveyd123]

anyone?

 

[eyec]

possible the sender is inadvertently sending email in text mode versus html

 

[rgwillia]

I am having the exact same issue for the last month and a half. It only happens with synacor.com domains. I have had at least 4 users from their domain with the same problem. I have a case opened with their support department. I would be interested to know what your environment looks like to see if there are any similarities between the two setups. If you get a chance call me at 239-246-6198.

 

[Daveyd123]

I am running a pretty basic network. All 2k3 servers with Exchange 2k3. All my clients are Outlook 2k3

 

[rgwillia]

What about virus and spam scanning software and or servers?

 

[Daveyd123]

We use Mcafee 8.5i with ePo for virus scan as well as SurfControl for our SPAM filter

 

[Daveyd123]

Any luck?

 

[Daveyd123]

Anything yet?

 

[58sniper]

Are the AV solutions configured to exclude the required Exchange folders?

Pat Richard
Microsoft Exchange MVP

 

[Daveyd123]

I don't have an AV solution on my Exchange Cluster. I use SurfControl's Email filter's intergrated AV. After the email is scanned its passed to the cluster

 

[rgwillia]

I think we have solved our problem. We use Surfcontrol ONLY for content management of emails. (make sure there are no 4 letter words and such)

We have a completely different solution for our AV and SPAM filtering. When we disabled Surfcontrol (but not our antispam or AV) it appears that the problem has gone away. Our email vendor (We outsource our exchange hosting, spam scanning, antivirus and content management to an MSP) is working with the developers of Surfcontrol to find out what could cause this problem.