I have been working on this issue for some time.
Environment:
Client - Windows xp SP3, Office 2007, ESET NOD32
Server - Exchange 2010 SP1 - Spam Agents Installed on Hub Transport - ESET for Exchange Install as well
Issue: Emails are being sent to junk mail that are not junk and we cannot find a way to stop it.
What we have tried:
Turning off client AV/AS
Turning off server ESET Based AS
Unintalling Exchange AS Agents.
Attempting to trace issue with headers, etc..
What I really need is to know how Outlook knows that it did not put the email in Junk. Is there any way (headers, mapi etc...) to see what moved the email to Junk. Exchange Message tracking has an entry clearly showing a move to junk as the last entry after delivery, does this mean Exchange did it or could it still be another program?
Any help would be appreciated.
Relevent Headers from a junk email:
Thread-Index: Acwxpg0lYaJDGE0/RrGDjaWPtV2NEQAFhE6PAAAn7xA=
Date: Thu, 23 Jun 2011 15:47:22 +0000
Message-ID: <680101FC589EBE4A99F187D676E7278303CE6BB5@mbx022-e1-nj-10.exch022.domain.local>
References: <680101FC589EBE4A99F187D676E7278303CE68B1@mbx022-e1-nj-10.exch022.domain.local>
<CA28D715.4A9B1%xxxxxxx@xxxxxx.com>
In-Reply-To: xxxxxxxxx
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [216.215.174.66]
Content-Type: multipart/mixed;
boundary="_004_680101FC589EBE4A99F187D676E7278303CE6BB5mbx022e1nj10exc_"
MIME-Version: 1.0
Return-Path: xxxxxxxx@xxxxxxxxxx.com
X-MS-Exchange-Organization-AuthSource: Exchange-01.dualprinting.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: structuritworldwide.com
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (Exchange-01.dualprinting.com:
xxxxxx@xxxxxxxxxxxx.com does not designate permitted sender hosts)
X-ESET-AS: SCORE=0
X-MS-Exchange-Organization-SCL: 0
X-EsetResult: clean, is OK
X-EsetId: E8026B22D042E170B247