<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2963" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hello,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>We run Exchange 2003 SP2 with MailScanner in front
of it.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>We have recently been sent some spam messages that
we initially were unable to delete via Outlook (2000 or 2003), OWA and
IMAP.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>After an investigation it transpired that in fact
the messages could in fact be deleted (shift-delete in Outlook) although they
couldn't be moved (into other folders, such as 'Deleted Items'). Attempting to
move the messages via IMAP resulted in "An error occurred calling into the
Microsoft Exchange Information Store service: the call to EcMoveCopyMessages
failed with error 0x8004011b." from the Information Store.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>The subject lines are similar
to:<BR>"Tuesday.CRSVF.puts him in a "</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Our spam.actions.rules file default action
is:</FONT></DIV>
<DIV><FONT face=Arial size=2>FromOrTo:
default deliver attachment
header "X-Spam-Status: Yes"</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>The sender address looked malformed in the
MailScanner produced email that wraps the spam message:<BR>From: "\"George
Roman\" <</FONT><A href='mailto:tkuhn@rvapc.com>{SET":tkuhn@rvapc.com'><FONT
face=Arial size=2>tkuhn@rvapc.com>{SET":tkuhn@rvapc.com</FONT></A></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>The attached spam email has the following address,
which although invalid looks different to the MailScanner produced
version:</FONT></DIV>
<DIV><FONT face=Arial size=2>From: "George Roman" <<A
href="mailto:tkuhn@rvapc.com>{SET:debug=11">tkuhn@rvapc.com>{SET:debug=11</A>}</DIV>
<DIV> </DIV>
<DIV>Has anyone seen this?</DIV>
<DIV> </DIV>
<DIV>Regards,</DIV>
<DIV> </DIV>
<DIV>Kris.<BR></DIV></FONT></BODY></HTML>