F-Secure Email and Server security strips random xls files

hyvokar

Hi, 

 

We are running F-secure Email and Server security premium on 2008R2 , exchange 2010 server. 

For some reason, random .xls files are not coming trough.

 

When I check from web console Email traffic scanning -> strip these attachments -> edit, the .xls extension is NOT listed. 

 

When I check FIle Quarantine, there are no items quarantined.

 

When I check Email Quarantine -> query it says "Disallowed attachment" for the mails that contained the .xls 

 

 

We had this problem (couple of montsh?) before. If I recall correctly then the attachments was atleast found on the quarantine. I was told by F-secure support that the problem had been fixed.

 

Any idea how to fix this?

etomcat

Hello,

 

Please upload falsely blocked Excel file samples here:

https://www.f-secure.com/en/web/labs_global/submit-a-sample

 

Tick the "give more details" checkbox and provide your e-mail address, so that the F-Secure Virus Analysis Lab will send their answer to you. Please also copy the "disallowed attachment" blocking warning in the textual message field and click Submit.

 

You should receive an automatic e-mail with the lab ticket number in it almost immediately. I usually receive a definitive response from a human within 1 day, sometimes 2 days when using that method to report false alarms.

 

Best Regards: Tamas Feher, Hungary.

hyvokar

According to FS analysis, the file is clean, but still gets caught.

etomcat

Hello,

 

I recently had a similar support case about "F-Secure 12.12 for Exchange" and the vendor responded with this advice:

 

"The Reason why these attachments may be blocked is because the customer might have set these files in the "Disallowed Outbound Files" section, found in the Attachments tab.

 

That means the file can be blocked, since it is either a XLS or XLA file, or maybe it includes VBA macros. The customer might want to change settings for policy "Disallowed outbound / inbound files" by removing the VBA from the list. Please also see the attached screenshots.

 

 

 

Customer may also create a "Trusted Senders" address list and exclude those senders from Disallowed Inbound / Outbound Files. That way only trusted senders can send emails which include XLS and XLA attachments with VBA macros."

 

That was F-Secure factory support's response.

 

Best Regards: Tamas Feher, Hungary.

hyvokar

Got the same reply, but the file does not have vba macros in it.

MJ-perComp

I think you should open a support case and profide the logfiles.
There were similar Problems earlier this year, but those have been fixed AFAIK.

Please report the ticket ID to @Vad (not here) for escalation to Virus-Lab.

 

M.

hyvokar

Hi,
Leaving for a vacation today. I have already opened two tickets concerning this case. Let's hope support comes up with something during my vacation.