F-Secure Email and Server security strips random xls files

hyvokar
hyvokar W/ Alumni Posts: 165 Junior Protector

Hi, 

 

We are running F-secure Email and Server security premium on 2008R2 , exchange 2010 server. 

For some reason, random .xls files are not coming trough.

 

When I check from web console Email traffic scanning -> strip these attachments -> edit, the .xls extension is NOT listed. 

 

When I check FIle Quarantine, there are no items quarantined.

 

When I check Email Quarantine -> query it says "Disallowed attachment" for the mails that contained the .xls 

 

 

We had this problem (couple of montsh?) before. If I recall correctly then the attachments was atleast found on the quarantine. I was told by F-secure support that the problem had been fixed.

 

Any idea how to fix this?

Comments

  • etomcat
    etomcat W/ Alumni Posts: 1,172 Firewall Master

    Hello,

     

    Please upload falsely blocked Excel file samples here:

    https://www.f-secure.com/en/web/labs_global/submit-a-sample

     

    Tick the "give more details" checkbox and provide your e-mail address, so that the F-Secure Virus Analysis Lab will send their answer to you. Please also copy the "disallowed attachment" blocking warning in the textual message field and click Submit.

     

    You should receive an automatic e-mail with the lab ticket number in it almost immediately. I usually receive a definitive response from a human within 1 day, sometimes 2 days when using that method to report false alarms.

     

    Best Regards: Tamas Feher, Hungary.

  • hyvokar
    hyvokar W/ Alumni Posts: 165 Junior Protector

    According to FS analysis, the file is clean, but still gets caught.

  • etomcat
    etomcat W/ Alumni Posts: 1,172 Firewall Master

    Hello,

     

    I recently had a similar support case about "F-Secure 12.12 for Exchange" and the vendor responded with this advice:

     

    "The Reason why these attachments may be blocked is because the customer might have set these files in the "Disallowed Outbound Files" section, found in the Attachments tab.

     

    That means the file can be blocked, since it is either a XLS or XLA file, or maybe it includes VBA macros. The customer might want to change settings for policy "Disallowed outbound / inbound files" by removing the VBA from the list. Please also see the attached screenshots.

     

    fsav_for_exchange_incoming_emails.png

     

     

    fsav_for_exchange_outgoing_emails.png

    Customer may also create a "Trusted Senders" address list and exclude those senders from Disallowed Inbound / Outbound Files. That way only trusted senders can send emails which include XLS and XLA attachments with VBA macros."

     

    That was F-Secure factory support's response.

     

    Best Regards: Tamas Feher, Hungary.

  • hyvokar
    hyvokar W/ Alumni Posts: 165 Junior Protector
    Got the same reply, but the file does not have vba macros in it.
  • MJ-perComp
    MJ-perComp W/ Alumni Posts: 669 Firewall Master

    I think you should open a support case and profide the logfiles.
    There were similar Problems earlier this year, but those have been fixed AFAIK.

    Please report the ticket ID to @Vad (not here) for escalation to Virus-Lab.

     

    M.

  • hyvokar
    hyvokar W/ Alumni Posts: 165 Junior Protector
    Hi,
    Leaving for a vacation today. I have already opened two tickets concerning this case. Let's hope support comes up with something during my vacation.
This discussion has been closed.