Email and Server security strips XLS files (not Autorun macro) with exclusion

Scholar

Email and Server security strips XLS files (not Autorun macro) with exclusion

Hi,

is there any news on the problem. I have the same symtoms.

BR

1 ACCEPTED SOLUTION

Accepted Solutions
Moderator

Re: F-Secure Email and Server security strips random xls files

Hi DaFit

 

Thank you for your patience. We have an update on your issue and will let you know once we have developed a fix.

 

We have checked your XLS file and ran a few tests. It seems sometimes Excel saves common XSLX files as XLS with _VBA_PROJECT_CUR inside.

 

So, our products strips your XLS because there is that _VBA_PROJECT_CUR folder, even if there are no actual macros is inside.
23 REPLIES 23
Moderator

Re: F-Secure Email and Server security strips random xls files

Hi DaFit

 

Can you please check the logfile from C:\ProgramData\F-Secure Logfile.log can show a similar log entry:


'example.xls' matches 'Disallowed Inbound Files' stripping condition; Real type: application/vnd.ms-excel; description: Microsoft Compound Document;Microsoft Excel Document; VBA;doc_long: Microsoft Excel 2003 Worksheet;doc_class: Biff8;doc_spec: Excel.Sheet.8;appname: Microsoft Excel; extensions: XLS XLA VBA

 

This means that the file has been blocked since it is either a XLS or XLA file, or it includes VBA macros.

 

You can try to change the settings for policy Disallowed Inbound Files by removing the VBA from the list, and see if that improve the situation.

Scholar

Re: F-Secure Email and Server security strips random xls files

Dear jamesch,

i got this Answer also from the F Secure Support team today.
 
Yes, in the log ist the same message. 
We block VBA but not XLS/XLA.
In the XLS is no macro.

I dont want VBA but i want to receive XLS.
It works, if i send the same Document saved as XLSX or as XLSM.
Moderator

Re: F-Secure Email and Server security strips random xls files

Hi DaFit

 

Do you have ESS Standard or Premium installed ?

 

We have a hotfix to exclude VBA autorun.macro which I can send you the download link for.

Scholar

Re: F-Secure Email and Server security strips random xls files

Hi jamesch,

 

i use ESS Version 12.12 Standard.

 

But its no Autorun.macro error.

 

 Reason: Attachment 'Filename.xls' matches 'Disallowed Files' stripping condition; Real type: application/vnd.ms-excel; description: Microsoft Compound Document;Microsoft Excel Document; VBA;doc_long: Microsoft Excel 2003 Worksheet;doc_class: Biff8;doc_spec: Excel.Sheet.8;appname: Microsoft Excel; extensions: XLS XLA VBA

 

Best regards

Superuser

Re: F-Secure Email and Server security strips random xls files

Dear Jamesch,

 

> We have a hotfix to exclude VBA autorun.macro which I can send you the download link for.

 

Could we receive the hotfix? We had a support case (xxxxxx) with a local customer which may have been related to the same problem.

 

Thanks in advance, Yours Sincerely:
Tamas Feher, 2F 2000 Kft., Hungary.

 

EDIT: Removed case number

Highlighted
Moderator

Re: F-Secure Email and Server security strips random xls files

Hi DaFit

 

I would suggest you to disable Email Traffic Scanning > Incoming Email  > "Intelligent file type recognition", and let me know if the .XLS file is still being blocked.

Moderator

Re: F-Secure Email and Server security strips random xls files

Please check your inbox. I have just messaged you the links for the hotfix

Scholar

Re: F-Secure Email and Server security strips random xls files

Dear jamesch,
after disabling the "Intelligent file type recognition" the xls work.

would this hotfix also work for that?
br

Moderator

Re: F-Secure Email and Server security strips random xls files

This particular hotfix provides exclusions for the following infections:

Trojan-Downloader:W32/Kavala.W

Trojan:W97M/AutorunMacro.B

 

 Your case seems to be because of this: Real type: application/vnd.ms-excel