Community
User Guides
Support
Community
Help Forums
English Forum
General
About our Community
General Discussion
News and Feedback
Products
F-Secure SAFE
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Other products
Beta programs
Feature Requests
Finnish Forum (Tukifoorumi)
Tuotteet Kotiin
F-Secure SAFE
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Muut tietoturvatuotteet
Support Articles
Language
English
Suomi
Deutsch
Français
日本語
Svenska
Dansk
Italiano
Nederlands
Norsk
Polski
中文 (繁體)
Products & Services
F-Secure TOTAL
F-Secure SAFE / Internet Security / Anti-Virus
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Other products
Common topics
User Guides
Support
Login
|
Register
XLS(M) Attachment "matches 'Disallowed Inbound Files' stripping condition" - F-Secure Community
<main> <article class="userContent"> <h3 data-version="7" data-article="000002345" data-id="issue">Issue:</h3> <p></p><ul><li>.XLS and .XLA attachments are blocked by F-Secure filter</li><li>The following attachment has been stripped:<br> Source: user1@example.com<br> Destination: support@domain.com<br> File name: 41125001012.xls<br> File size: 192000 bytes<br> Scan result: Attachment '41125001012.xls' matches 'AttachmentFiltering::Included' stripping condition; Real type: application/vnd.ms-excel; description: Microsoft Compound Document;Microsoft Excel Document; <b>VBA</b>;doc_long: Microsoft Excel 2003-workstattion;doc_class: Biff8;doc_spec: Excel.Sheet.8;appname: Microsoft Excel; extensions: XLS XLA VBA<br> Action: <b>Dropped</b><br> Quarantine ID: 20095<br> </li></ul><h3 data-id="resolution">Resolution:</h3> <p></p><div>Reason why these attachments are blocked is because you might have set a match list to strip attachments for one of the following policy routes <b>Incoming email, Outgoing email</b> or <b>Internal email.</b><br><br>Your match list might contain some of these extensions:<br>*.BAT *.CMD *.COM *.EXE *.HTA *.JS *.JSE *.PIF *.SCR *.SHS *.VBE *.VBS *.zip .VBA *. *.xls*.doc*<br>This means that the file has been blocked since it is either a XLS or XLA file, or it includes VBA, VBE OR vbs macros.<br>By default these are blocked by our filter.<br><br>If you want to allow the macros, you need to remove them from <b>Disallowed list</b> "match list" and possibly whitelist them so that scanning engine does not detect as potentially malicious.<br>Which might happen later when they are whit-listed, since now they are only disallowed!<br><br>You can also create a <b>Trusted Senders</b> list and Exclude these senders from <b>Disallowed Inbound Files</b><br>This way only trusted senders can send emails which include XLS and XLA attachments with VBA macros.<br><br>You can query email quarantine for dropped attachments or messages using the F-Secure Email and Server Security web console.</div> <ol><li>From your <b>target server</b> login to the <b>Web console </b>example <a rel="nofollow" href="https://127.0.0.1:25023/eq/query">https://127.0.0.1:25023/</a></li><li>Scroll down to<b> Email Quarantine, Query </b>and select Object type <b>Attachments </b>from the drop down menu and press <b>Query</b></li></ol> This way you will get results for the dropped attachments, where you will also see the reason why this attachment has been filtered.<br><br><div>or<br>You can look for logs:<br>For <b>Email and Server Security 12.xx </b> you can look for<b> Logfile.log </b>which will show you similar entries.<br>'example.xls' matches 'Disallowed Inbound Files' stripping condition; Real type: application/vnd.ms-excel; description: Microsoft Compound Document;Microsoft Excel Document; VBA;doc_long: Microsoft Excel 2003 Worksheet;doc_class: Biff8;doc_spec: Excel.Sheet.8;appname: Microsoft Excel; extensions: XLS XLA VBA<br><br>For <b>Email and Server Security 14.01 </b>you can look for<b> transportAgent.log </b>or<b> email-scan.log</b><br>which are located under C:\Windows\ServiceProfiles\NetworkService\AppData\Local\F-Secure\Log\ess and will show you similar entries:<br>Scan result: Attachment '41125001012.xls' matches 'AttachmentFiltering::Included' stripping condition; Real type: application/vnd.ms-excel; description: Microsoft Compound Document;Microsoft Excel Document; <b>VBA</b>;doc_long: Microsoft Excel 2003-workstattion;doc_class: Biff8;doc_spec: Excel.Sheet.8;appname: Microsoft Excel; extensions: XLS XLA VBA<br>Action: <b>Dropped</b><br>Quarantine ID: 20095</div> <p>Article no: 000002345</p> </article> </main>