English
Chinese (Simplified)
French
German
Italian
Japanese
Russian
Spanish
Vietnamese
Filter Error
-
HI,
Since the last update 9.0.0
The message content filter does not work correctly.
It is generating an error when scanning documents.
We have a filter that checks if the word "Bitcoin" exists in the body of the message, this worked correctly. Now it gives us an error.
Tue 2023-01-17 13:51:54: -- Ejecutando: bitcoin --
Tue 2023-01-17 13:51:54: Ocurrió un error al extraer texto del archivo ARCHIVO INCLUSION CARTERA.xlsx
Tue 2023-01-17 13:51:54:
Tue 2023-01-17 13:51:54: -- Término: bitcoin (0.367002 segundos) --
*****
Tue 2023-01-17 13:51:57: * Escaneo de mensaje fallido
Tue 2023-01-17 13:51:57: ** Fileinto adminthis is the rule
/* message content filter rule */
require ["securitygateway","reject","fileinto","envelope","body","regex"];
if allof(body :subject :text :contains "bitcoin")
{
fileinto "spam";
}I have also observed that all the exel files that are sent to us with macros are marked as viruses.
And in the SG configuration, the option of: Mark as attached virus with documents that contain macros is unchecked
Tue 2023-01-17 13:06:11: RCPT Domain = commcenter.es
Tue 2023-01-17 13:06:11: -- Ejecutando: Blacklist --
Tue 2023-01-17 13:06:11: -- Término: Blacklist (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: URI Blacklists (URIBL) --
Tue 2023-01-17 13:06:11: -- Término: URI Blacklists (URIBL) (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: SpamAssassin --
Tue 2023-01-17 13:06:11: -- Término: SpamAssassin (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: Mail Nocivo --
Tue 2023-01-17 13:06:11: -- Término: Mail Nocivo (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: Disa --
Tue 2023-01-17 13:06:11: -- Término: Disa (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: bitcoin --
Tue 2023-01-17 13:06:11: Ocurrió un error al extraer texto del archivo 00000APH 20230116 Informe KPIs operativos Detalle Vendedor.xlsm
Tue 2023-01-17 13:06:11:
Tue 2023-01-17 13:06:11: -- Término: bitcoin (0.498074 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: Cuarentena GLS --
Tue 2023-01-17 13:06:11: -- Término: Cuarentena GLS (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: Contraseña --
Tue 2023-01-17 13:06:11: -- Término: Contraseña (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: Contiene URL Activa --
Tue 2023-01-17 13:06:11: -- Término: Contiene URL Activa (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: Contiene IP --
Tue 2023-01-17 13:06:11: -- Término: Contiene IP (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: IP Pictel --
Tue 2023-01-17 13:06:11: -- Término: IP Pictel (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: @secosum.com IP Virus --
Tue 2023-01-17 13:06:11: -- Término: @secosum.com IP Virus (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: IP Pictel Mensaje --
Tue 2023-01-17 13:06:11: -- Término: IP Pictel Mensaje (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: pagofacilde@telefonicaconsumerfinance.net --
Tue 2023-01-17 13:06:11: -- Término: pagofacilde@telefo.........sumerfinance.net (0.000000 segundos) --
Tue 2023-01-17 13:06:11: -- Ejecutando: Domain: commcenter.es - Anti-Virus --
Tue 2023-01-17 13:06:11: Procesando el mensaje con el anti-virus (Tamaño: 5190813)...
Tue 2023-01-17 13:06:11: * Escaneando el mensaje utilizando: ClamAV for SecurityGateway
Tue 2023-01-17 13:06:24: * Mensaje infectado con Xls.Exploit.LokiBot-9983602-0 virus
Tue 2023-01-17 13:06:24: ** Fileinto admin
Tue 2023-01-17 13:06:24: -- Término: Domain: commcenter.es - Anti-Virus (12.268339 segundos) --
Tue 2023-01-17 13:06:24: -- Ejecutando: Domain: commcenter.es - Outbreak Protection (Anti-Virus) --
Tue 2023-01-17 13:06:24: Procesando el mensaje con Outbreak Protection (Tamaño: 5190813)…
Tue 2023-01-17 13:06:25: * Reference-ID: str=0001.0A782F18.63C68F41.004A,ss=1,re=0.000,recu=0.000,reip=0.000,vtr=str,vl=0,cl=1,cld=1,fgs=0
Tue 2023-01-17 13:06:25: * Nivel de amenaza de Spam: Clean
Tue 2023-01-17 13:06:25: * Nivel de amenaza del Virus: Clean
Tue 2023-01-17 13:06:25: -- Término: Domain: commcenter.es - Outbreak Protection (Anti-Virus) (1.310720 segundos) --
Tue 2023-01-17 13:06:25: -- Ejecutando: Domain: commcenter.es - Outbreak Protection (Spam) --
Tue 2023-01-17 13:06:25: -- Término: Domain: commcenter.es - Outbreak Protection (Spam) (0.000000 segundos) --
Tue 2023-01-17 13:06:25: -- Ejecutando: Domain: commcenter.es - DMARC --
This macros is clean.These macros are clean, and do not contain any kind of virus.
Do you know what could be happening?
-
-
-
-
Matthew Staff
-
Please login to reply to this topic!
