I'm seeing a virus in our network with some strange headers.  Sometimes they are coming (sourced) from a netscaler VIP, other times they seem to come from an Exchange hub server.

How do I determine the origin of this virus?  (workstation, etc)

I'm thinking that this has to do with special authentication of the receive connector (MX Exchange auth?) that allows acceptance of the message.

Received: from EXMB01.company.com ([xxxx:66bb]) by EXHUB02.company.com ([2.2.2.192]) with mapi id 14.03.0195.001; Wed, 15 Oct 2014 09:55:26 -0400
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: "Dale Chip" <Chip.Dale@company2.com>
Subject: Unpaid invoic
Thread-Topic: Unpaid invoic
Thread-Index: Ac/of6pWLOgzgrBLQM2EB7owtQTxYw==
Date: Wed, 15 Oct 2014 09:55:25 -0400
Message-ID: <18FD6D6FDFA36A40A04B6C1C63B3A2E8B13DD353@MB01.company.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <18FD6D6FDFA36A40A04B6C1C63B3A2E8B13DD353@EXMB01.company.com>
MIME-Version: 1.0
X-MS-Exchange-Organization-AuthSource: HUB02.company.com
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-Originating-IP: [2.2.2.171]
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-MS-Exchange-Organization-Recipient-P2-Type: Bcc


OpenSSL s_client
To check if you have disabled the SSLv3 support, then run the following
openssl s_client -connect example.com:443 -ssl3

which should produce something like
3073927320:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1258:SSL alert number 40
3073927320:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596:

meaning SSLv3 is disabled on the server.  Otherwise the connection will established successfully.
Nmap
Alternatively, you can use nmap to scan server for supported version:
# nmap --script ssl-enum-ciphers example.com
Starting Nmap 6.47 ( http://nmap.org ) at 2014-10-15 03:19 PDT
Nmap scan report for example.com (203.0.113.100)
Host is up (0.090s latency).
rDNS record for 203.0.113.100: edge.example.com
Not shown: 997 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https
| ssl-enum-ciphers: 
|   **SSLv3: No supported ciphers found**
|   TLSv1.0: 

