Need a way to modify a Subject Line in Outlook Email using Scripts or Rules

[questorfla]

Help!  I hope someone else has had to do this and it is easy to accomplish.
Being the IT guy, I have full access to our mail server.   So I Know for a fact this is not being done there or by us.
But some mail server or some application (or maybe some malware ?) has decided to put the word "***SPAM***" in the subject line if a lot of email that is sent from a couple of users here.  I have tried my best to explain to them that if they Don't even bother to delete that word before they forward the message on, it leave me with no way to know when it happened. 
But trying to explain email "How Email Really Works"  to most people is the subject of many a cartoon.

Right now I just need a Bandage to get by until I can figure out who did it to whom.

I cannot see a way to remove that from the subject line.  I can scan for it  find it  but my options  if it is found do not include "remove this word" which is all I need for now.

I know this has happened in the past with AVG but no one uses AVG and this header marker is VERY specific  it ALWAYS puts that same "***SPAM***"
Preceding the subject.  If I could get it out for now it would help.  They forward email back and forth constantly so this mark is all there but who knows from where it started? 

Any help with a temporary fix would be appreciated. It sounds more like something MALWARE would do to me.

[x16wda]

What kind of spam-blocking software is used on your mail server, or what external service are you using?  What kind of mail server software (MTU) is it (Exchange, postfix, sendmail...)?

[questorfla]

IPSWITCH is a major email company.  We have Hosted mail.   I have direct access to all the terms that can be used as well as when they can be sued.
Nothing has any **'s in it
"Suspected Spam" is as bad is it gets.  Other than that, we have tried disabling every single check.  So much so, that I am concerned that it too much.

The people affected are the Owners (of course)  not anyone else.  At least not as far as I know.  They send me email that has been forwarded to almost everyone an d in each forward.  NO ONE even bothers to change the subject,  (DUH)
So of course, the word appears in every one,  Then they send ME the multi forwarded SPAM email.
All I can see in  the header is the last person who sent it.
I have had IPSWITCH run a check too.  We all need the same thing.\ONE single email that started out clean and ended up at the next person dirty
If I could get that forwa4rded as an attachment I could put an end to the mystery but... TRY as I might, they seem to WANT to NOT understand!

SO.. I am going to for now kill the problem.  hey are all out of town, I cannot speak to them personally and even if I did, they STILL won't understand.

[questorfla]

Oh,  OUTLOOK 2010/2013 using POP/SMTP and or IMAP.  As they ALL have two or three cellphones that have the exact same email accounts.
Plus IPADS and BLACKBERRIES!

[Shades]

Most mail server software already have a spam-filter build in. For postfix (linux) that would be spam-assassin, if memory serves me right. And you can configure there if mails marked as spam automatically get *** SPAM *** added to the subject line. With the default configuration of Exchange 2010 I know that there are limits in how much messages can be sent per minute, just so you don't trigger anti-spam measures that are in place either internally or externally. Most professional email solutions will have something similar I'm sure.

Depending on your geographic location different organizations patrol the web marking you as a spammer when they see that is needed and then you'll have to prove to that organization that you aren't before they remove the block on all your (outgoing) mail. Had that happen twice to me, because some kid had installed a cheat or something for an online game he was playing. 

You should be able to access the logging. From there it shouldn't be that difficult to see who is the responsible user. If there is no such option, it sounds like you are at the mercy of either IPSWITCH or those "guardians".

Ah well, this is another example (for me) that shows you shouldn't depend too much on 3rd parties that over-promise and under-deliver, which is the bulk of cloud service providers (to me).

[Stoic Joker]

Oh,  OUTLOOK 2010/2013 using POP/SMTP and or IMAP.  As they ALL have two or three cellphones that have the exact same email accounts.
Plus IPADS and BLACKBERRIES!

-questorfla (April 14, 2014, 09:57 PM)

Zoiks! ...Any chance of accessing (by webmail or other) their mailbox to search for a clean header sample for them? I've had to do that several times in the interest of time (mine specifically - I hate having it wasted) because of users lacking the capacity to grasp the excruciating importance of trying to troubleshoot mail flow problems with a pristine header sample.

Ah well, this is another example (for me) that shows you shouldn't depend too much on 3rd parties that over-promise and under-deliver, which is the bulk of cloud service providers (to me).

-Shades (April 14, 2014, 10:22 PM)

+10 - I'll be keeping my Exchange server here in house, where GFi and I can keep a close eye on it.

[questorfla]

Oh well. 'No Joy in Mudville tonight.  The mighty Casey has Struck Out'

I know it can be done.  The Ipswitch techs say they don't see why it could NOT be done  BUT of course they have NO idea how. There is nothing in the Mail-Admin toolbox for doing something like that.   I can ADD all kinds of stuff to their headers based on what markers I choose,  BUT,  I cannot find a single way to even so much as EMPTY the subject.  That would be preferable to leaving the SPAM.
Eventually one of them will finally send me a ONE PERSON email so I can analyze the header but until they do, Nothing I can do.


And of course, it will be MY fault that they took so long to do it.  The IT guys worst enemy is himself.  Being really good at what you do can get you in more trouble than being a slacker.  If you are a lousy Admin, they get used to that and don't expect anything.  But.. if you happen to be good at it, you better PRAY you can STAY good forever.  User Errors are not accepted excuses.

I wonder is there is a way to truncate any subject line by 10 characters if those 10 are "***SPAM***"OR
Add 10 delete characters to the front of the line to suck those 10 characters into oblivion.

If there was some common denominator to those that are marked, but nothing we can find and several techs spent a few hours scratching heads.
Some email from SOME users Some times gets hit.  Other email from same users does not.

I cant believe there is no way to create a rule to delete the entire subject line.  I CAN create a rule that checks for the ***SPAM*** and "run a Script" if found but apparently no one knows what the script would have to say to even just empty the subject line if it cannot be surgical, use an AXE.  In cases like this Nothing is better than something if the something still says spam.
A little Human Help would be nice but for the Life of me I don't understand why I cannot get them to simply take 10 seconds to delete the offending phrase before forwarding it to 15 other people like they think it will magically go away on it's on.

It might get put BACK but if it does then I at least have a clue.

Right now the ONLY clue I have is that whatever it is, it happens AFTER the first reply.  The first reply says "***SPAM***" RE: subject....
after than, it is RE:"***SPAM***" Subject.  So the FIRST time it happens it is done by something after it leaves their Outlook.

On subsequent forwards.  the RE: (reply) part is in FRONT of the "***SPAM***"

   "Sigh"