I'm seeing a virus in our network with some strange headers. Sometimes they are coming (sourced) from a netscaler VIP, other times they seem to come from an Exchange hub server.
How do I determine the origin of this virus? (workstation, etc)
I'm thinking that this has to do with special authentication of the receive connector (MX Exchange auth?) that allows acceptance of the message.
Received: from EXMB01.company.com ([xxxx:66bb]) by EXHUB02.company.com ([126.96.36.199]) with mapi id 14.03.0195.001; Wed, 15 Oct 2014 09:55:26 -0400 Content-Type: application/ms-tnef; name="winmail.dat" Content-Transfer-Encoding: binary From: "Dale Chip" <Chip.Dale@company2.com> Subject: Unpaid invoic Thread-Topic: Unpaid invoic Thread-Index: Ac/of6pWLOgzgrBLQM2EB7owtQTxYw== Date: Wed, 15 Oct 2014 09:55:25 -0400 Message-ID: <18FD6D6FDFA36A40A04B6C1C63B3A2E8B13DD353@MB01.company.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-Exchange-Organization-SCL: -1 X-MS-TNEF-Correlator: <18FD6D6FDFA36A40A04B6C1C63B3A2E8B13DD353@EXMB01.company.com> MIME-Version: 1.0 X-MS-Exchange-Organization-AuthSource: HUB02.company.com X-MS-Exchange-Organization-AuthAs: Internal X-MS-Exchange-Organization-AuthMechanism: 04 X-Originating-IP: [188.8.131.52] X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-MS-Exchange-Organization-Recipient-P2-Type: Bcc