I'm seeing a virus in our network with some strange headers. Sometimes they are coming (sourced) from a netscaler VIP, other times they seem to come from an Exchange hub server.

How do I determine the origin of this virus? (workstation, etc)

I'm thinking that this has to do with special authentication of the receive connector (MX Exchange auth?) that allows acceptance of the message.

Received: from EXMB01.company.com ([xxxx:66bb]) by EXHUB02.company.com ([]) with mapi id 14.03.0195.001; Wed, 15 Oct 2014 09:55:26 -0400
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: "Dale Chip" <Chip.Dale@company2.com>
Subject: Unpaid invoic
Thread-Topic: Unpaid invoic
Thread-Index: Ac/of6pWLOgzgrBLQM2EB7owtQTxYw==
Date: Wed, 15 Oct 2014 09:55:25 -0400
Message-ID: <18FD6D6FDFA36A40A04B6C1C63B3A2E8B13DD353@MB01.company.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <18FD6D6FDFA36A40A04B6C1C63B3A2E8B13DD353@EXMB01.company.com>
MIME-Version: 1.0
X-MS-Exchange-Organization-AuthSource: HUB02.company.com
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-Originating-IP: []
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-MS-Exchange-Organization-Recipient-P2-Type: Bcc
  • Virus is an executable, nothing to do with email headers. If the email has executable attachment you'll see it very quickly. – Jeremy Oct 15 '14 at 14:15
  • 1
    @Jeremy but emails can contain attachments which contain viruses... – schroeder Oct 15 '14 at 14:25
  • Is it you who have replaced hostnames with "company.com" and "company2.com" ? – Dog eat cat world Oct 15 '14 at 14:46
  • Yes, I did anonymise the headers slightly. Those were internal and or known hosts. @Dogeatcatworld – goodguys_activate Oct 15 '14 at 14:49
  • I am seeing these same emails flowing between my organization's customers. It appears to be a workstation infection and spreads itself when you open it to people in your address book, but also appears to be picky and only choose people it thinks will open it based on your email history in some way. As of right now, neither our Barracuda filter nor ESET NOD32 is not recognizing the exploit. – cscracker Oct 15 '14 at 15:37

Checked it out. Authmechanism=04 is a hexadecimal notation that tells you that the Exchange server did authenticate by IP-address. With this, I mean that you have configured your Exchange server to treat certain IP addresses or ranges to be "trusted" in the parlance that it will bypass regular username/password authentication and/or eventual spam/virus filters.

The mail originates from a machine with IP This IP could be a intermediate server. Then you might need to check the logs of that server.

| improve this answer | |
  • Could you elaborate on how to found that IP address? – RoraΖ Oct 15 '14 at 15:59
  • It was in X-Originating-IP. After I posted my reply, he have edited his question. – sebastian nielsen Oct 15 '14 at 17:25

Use http://www.ipligence.com/geolocation or something similar to geolocate an ip address

in case of, that is a private IP address located on your network

Private IP address ranges

The ranges and the amount of usable IP's are as follows: - Addresses: 16,777,216 - Addresses: 1,048,576 - Addresses: 65,536

Tracing these virii routed messages may be difficult. It's easy for a hacker to get control of a zombie computer anywhere in the world, spoof the mac address and IP address, and send from there. If done through multiple proxies, and the original connection is on a mobile PC based in a free Starbucks WiFi, it will not be possible to trace.

Hope that helps

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.