All Word docs getting quarantined incorrectly | MDaemon Technologies, Ltd.

All Word docs getting quarantined incorrectly


  • Since updating to SecurityGateway 9.0, any e-mail with a Word document attached is getting quaratentined because it appears the Cyren antivirus engine fails to scan it.  This is the relevent potion from the transmission log:

    Thu 2023-01-19 13:06:45: Passing message through anti-virus (Size: 105889)...
    Thu 2023-01-19 13:06:45: * Scanning message using: ClamAV for SecurityGateway
    Thu 2023-01-19 13:06:46: * Message is clean (no viruses found)
    Thu 2023-01-19 13:06:46: * Scanning message using: Cyren Anti-Virus for SecurityGateway
    Thu 2023-01-19 13:06:46: * Message scanning failed
    Thu 2023-01-19 13:06:46: ** FILEINTO admin
    Thu 2023-01-19 13:06:46: -- End: Anti-Virus (0.471859 seconds) --
     
     


  • I was not able to reproduce the issue.

    Can you send me an MSG file for a message  that you have had the issue with?

    You can send it to arron.caruth@mdaemon.com, please reference your post.


  • @Arron Sent you a sample as requested.


  • Hi,

    I have the same problem, word and excel. 

    on 2023-01-23 11:38:16: Aceptando SMTP conexión desde [23.83.212.46 : 36287] en el puerto 25
    Mon 2023-01-23 11:38:17: El remitente no es un servidor de correo local
    Mon 2023-01-23 11:38:17: ========== Procesando IP scripts
    Mon 2023-01-23 11:38:17: -- Ejecutando: Location Screening --
    Mon 2023-01-23 11:38:17: Se detectó conexión del país: Canadá
    Mon 2023-01-23 11:38:17: Se detectó conexión del código de país: CA
    Mon 2023-01-23 11:38:17: ** Agregar encabezado: X-SGOrigin-Country
    Mon 2023-01-23 11:38:17: -- Término: Location Screening (0.000000 segundos) --
    Mon 2023-01-23 11:38:17: -- Ejecutando: Blacklist --
    Mon 2023-01-23 11:38:17: -- Término: Blacklist (0.000000 segundos) --
    Mon 2023-01-23 11:38:17: ========== Finalizar IP scripts
    Mon 2023-01-23 11:38:17: --> 220 commcenter.es ESMTP SecurityGateway 9.0.0; Mon, 23 Jan 2023 11:38:16 +0100
    Mon 2023-01-23 11:38:17: <-- EHLO cross.elm.relay.mailchannels.net
    Mon 2023-01-23 11:38:17: Realizando búsqueda de IP (cross.elm.relay.mailchannels.net)
    Mon 2023-01-23 11:38:17: * D=cross.elm.relay.mailchannels.net TTL=(5) A=[23.83.212.46]
    Mon 2023-01-23 11:38:17: ========== Procesando HELO scripts
    Mon 2023-01-23 11:38:17: -- Ejecutando: Blacklist --
    Mon 2023-01-23 11:38:17: -- Término: Blacklist (0.000000 segundos) --
    Mon 2023-01-23 11:38:17: -- Ejecutando: HELO DNS lookup --
    Mon 2023-01-23 11:38:17: -- Término: HELO DNS lookup (0.000000 segundos) --
    Mon 2023-01-23 11:38:17: ========== Finalizar HELO scripts
    Mon 2023-01-23 11:38:17: --> 250-commcenter.es Hello cross.elm.relay.mailchannels.net, pleased to meet you
    Mon 2023-01-23 11:38:17: --> 250-8BITMIME
    Mon 2023-01-23 11:38:17: --> 250-AUTH LOGIN PLAIN
    Mon 2023-01-23 11:38:17: --> 250-STARTTLS
    Mon 2023-01-23 11:38:17: --> 250 SIZE 0
    Mon 2023-01-23 11:38:17: <-- STARTTLS
    Mon 2023-01-23 11:38:17: --> 220 Begin TLS negotiation
    Mon 2023-01-23 11:38:18: Negociación SSL exitosa (TLS 1.2, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256)
    Mon 2023-01-23 11:38:18: <-- EHLO cross.elm.relay.mailchannels.net
    Mon 2023-01-23 11:38:18: Realizando búsqueda de IP (cross.elm.relay.mailchannels.net)
    Mon 2023-01-23 11:38:18: * D=cross.elm.relay.mailchannels.net TTL=(4) A=[23.83.212.46]
    Mon 2023-01-23 11:38:18: ========== Procesando HELO scripts
    Mon 2023-01-23 11:38:18: -- Ejecutando: Blacklist --
    Mon 2023-01-23 11:38:18: -- Término: Blacklist (0.000000 segundos) --
    Mon 2023-01-23 11:38:18: -- Ejecutando: HELO DNS lookup --
    Mon 2023-01-23 11:38:18: -- Término: HELO DNS lookup (0.000000 segundos) --
    Mon 2023-01-23 11:38:18: ========== Finalizar HELO scripts
    Mon 2023-01-23 11:38:18: --> 250-commcenter.es Hello cross.elm.relay.mailchannels.net, pleased to meet you
    Mon 2023-01-23 11:38:18: --> 250-8BITMIME
    Mon 2023-01-23 11:38:18: --> 250-AUTH LOGIN PLAIN
    Mon 2023-01-23 11:38:18: --> 250-REQUIRETLS
    Mon 2023-01-23 11:38:18: --> 250 SIZE 0
    Mon 2023-01-23 11:38:18: <-- MAIL FROM:<grojas@gestisae.net> SIZE=96943
    Mon 2023-01-23 11:38:18: Realizando búsqueda en Minger (192.168.xx.xx:4069 para grojas@gestisae.net)
    Mon 2023-01-23 11:38:18: Realizando búsqueda en Minger (192.168.xx.xx:4069 para grojas@gestisae.net)
    Mon 2023-01-23 11:38:18: Realizando búsqueda en Minger (192.168.xx.xx:4069 para grojas@gestisae.net)
    Mon 2023-01-23 11:38:18: Usuario no encontrado: <grojas@gestisae.net>
    Mon 2023-01-23 11:38:18: ========== Procesando AUTH scripts
    Mon 2023-01-23 11:38:18: -- Ejecutando: Secure and authenticated port rules --
    Mon 2023-01-23 11:38:18: -- Término: Secure and authenticated port rules (0.000000 segundos) --
    Mon 2023-01-23 11:38:18: -- Ejecutando: Dynamic Screening --
    Mon 2023-01-23 11:38:18: * Habilitando Filtrado Dinámico
    Mon 2023-01-23 11:38:18: -- Término: Dynamic Screening (0.000000 segundos) --
    Mon 2023-01-23 11:38:18: ========== Finalizar AUTH scripts
    Mon 2023-01-23 11:38:18: ========== Procesando MAIL scripts
    Mon 2023-01-23 11:38:18: -- Ejecutando: Invalid Sender --
    Mon 2023-01-23 11:38:18: -- Término: Invalid Sender (0.000000 segundos) --
    Mon 2023-01-23 11:38:18: -- Ejecutando: MAIL DNS Lookup --
    Mon 2023-01-23 11:38:18: Realizando búsqueda de MAIL (gestisae.net)
    Mon 2023-01-23 11:38:18: * P=010 D=gestisae.net TTL=(60) MX=[filtro.sendguardian.com]
    Mon 2023-01-23 11:38:18: -- Término: MAIL DNS Lookup (0.104858 segundos) --
    Mon 2023-01-23 11:38:18: -- Ejecutando: SMTP Authentication Required --
    Mon 2023-01-23 11:38:18: -- Término: SMTP Authentication Required (0.000000 segundos) --
    Mon 2023-01-23 11:38:18: ========== Finalizar MAIL scripts
    Mon 2023-01-23 11:38:18: --> 250 <grojas@gestisae.net>, Sender ok
    Mon 2023-01-23 11:38:19: <-- RCPT TO:<egonzalez@commcenter.es>
    Mon 2023-01-23 11:38:19: Usuario encontrado: <egonzalez@commcenter.es>
    Mon 2023-01-23 11:38:19: ========== Procesando RCPT scripts para el destinatario: egonzalez@commcenter.es
    Mon 2023-01-23 11:38:19: RCPT Domain = commcenter.es
    Mon 2023-01-23 11:38:19: -- Ejecutando: Blacklist --
    Mon 2023-01-23 11:38:19: -- Término: Blacklist (0.000000 segundos) --
    Mon 2023-01-23 11:38:19: -- Ejecutando: Tarpitting --
    Mon 2023-01-23 11:38:19: # Remitente está en lista blanca (Mail From user)
    Mon 2023-01-23 11:38:19: -- Término: Tarpitting (0.052429 segundos) --
    Mon 2023-01-23 11:38:19: -- Ejecutando: Relaying Denied --
    Mon 2023-01-23 11:38:19: -- Término: Relaying Denied (0.000000 segundos) --
    Mon 2023-01-23 11:38:19: -- Ejecutando: Invalid Recipient --
    Mon 2023-01-23 11:38:19: -- Término: Invalid Recipient (0.000000 segundos) --
    Mon 2023-01-23 11:38:19: -- Ejecutando: Validate Local Sender --
    Mon 2023-01-23 11:38:19: -- Término: Validate Local Sender (0.000000 segundos) --
    Mon 2023-01-23 11:38:19: -- Ejecutando: DNS Blacklists (client IP) --
    Mon 2023-01-23 11:38:19: -- Término: DNS Blacklists (client IP) (0.000000 segundos) --
    Mon 2023-01-23 11:38:19: -- Ejecutando: Callback Verification --
    Mon 2023-01-23 11:38:19: -- Término: Callback Verification (0.000000 segundos) --
    Mon 2023-01-23 11:38:19: -- Ejecutando: Domain: commcenter.es - SPF --
    Mon 2023-01-23 11:38:19: Performing SPF lookup (gestisae.net / 23.83.212.46)
    Mon 2023-01-23 11:38:19: * Policy: v=spf1 include:saferoute.sendguardian.com -all
    Mon 2023-01-23 11:38:19: * Evaluating include:saferoute.sendguardian.com: performing lookup
    Mon 2023-01-23 11:38:19: * Policy: v=spf1 include:relay.mailchannels.net -all
    Mon 2023-01-23 11:38:19: * Evaluating include:relay.mailchannels.net: performing lookup
    Mon 2023-01-23 11:38:19: * Policy: v=spf1 ip4:23.83.208.0/20 ip4:46.232.183.0/24 ip4:199.10.31.235/32 ip4:199.10.31.236/32 ip4:172.255.62.10/32 ip4:172.255.62.11/32 ip4:103.18.109.138/32 ip4:54.214.232.113/32 ~all
    Mon 2023-01-23 11:38:19: * Evaluating ip4:23.83.208.0/20: match
    Mon 2023-01-23 11:38:19: * Evaluating include:relay.mailchannels.net: match
    Mon 2023-01-23 11:38:19: * Evaluating include:saferoute.sendguardian.com: match
    Mon 2023-01-23 11:38:19: * Resultado: pass
    Mon 2023-01-23 11:38:19: -- Término: Domain: commcenter.es - SPF (0.052429 segundos) --
    Mon 2023-01-23 11:38:19: ========== Finalizar RCPT scripts
    Mon 2023-01-23 11:38:19: --> 250 <egonzalez@commcenter.es>, Recipient ok
    Mon 2023-01-23 11:38:20: <-- DATA
    Mon 2023-01-23 11:38:20: --> 354 Enter mail, end with <CRLF>.<CRLF>
    Mon 2023-01-23 11:38:20: Tamaño del mensaje: 96999 bytes
    Mon 2023-01-23 11:38:20: ID de Mensaje: <!&!AAAAAAAAAAAYAAAAAAAAAMdTQ+T623JAtTY4aC2kENXCgAAAEAAAAON5HocrxOFOqrN5pC6cPeYBAAAAAA==@gestisae.net>
    Mon 2023-01-23 11:38:20: Message creation successful: C:\Program Files\MDaemon Technologies\SecurityGateway\Inbound\39793a9743a94acea88953d702796d5d.MSG
    Mon 2023-01-23 11:38:20: ========== Procesando DATA scripts para el destinatario: egonzalez@commcenter.es
    Mon 2023-01-23 11:38:20: RCPT Domain = commcenter.es
    Mon 2023-01-23 11:38:20: -- Ejecutando: Blacklist --
    Mon 2023-01-23 11:38:20: -- Término: Blacklist (0.000000 segundos) --
    Mon 2023-01-23 11:38:20: -- Ejecutando: URI Blacklists (URIBL) --
    Mon 2023-01-23 11:38:20: -- Término: URI Blacklists (URIBL) (0.000000 segundos) --
    Mon 2023-01-23 11:38:20: -- Ejecutando: SpamAssassin --
    Mon 2023-01-23 11:38:20: -- Término: SpamAssassin (0.000000 segundos) --
    Mon 2023-01-23 11:38:20: -- Ejecutando: Mail Nocivo --
    Mon 2023-01-23 11:38:20: -- Término: Mail Nocivo (0.000000 segundos) --
    Mon 2023-01-23 11:38:20: -- Ejecutando: Disa --
    Mon 2023-01-23 11:38:20: -- Término: Disa (0.000000 segundos) --
    Mon 2023-01-23 11:38:20: -- Ejecutando: bitcoin --
    Mon 2023-01-23 11:38:21: Ocurrió un error al extraer texto del archivo CALENDARIO 2023.xlsx
    Mon 2023-01-23 11:38:21: LoadIFilter: Unknown error.
    Mon 2023-01-23 11:38:21: -- Término: bitcoin (0.052429 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: Contraseña --
    Mon 2023-01-23 11:38:21: -- Término: Contraseña (0.000000 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: Contiene URL Activa --
    Mon 2023-01-23 11:38:21: -- Término: Contiene URL Activa (0.000000 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: Contiene IP --
    Mon 2023-01-23 11:38:21: -- Término: Contiene IP (0.000000 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: IP Pictel --
    Mon 2023-01-23 11:38:21: -- Término: IP Pictel (0.000000 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: @secosum.com IP Virus --
    Mon 2023-01-23 11:38:21: -- Término: @secosum.com IP Virus (0.000000 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: IP Pictel Mensaje --
    Mon 2023-01-23 11:38:21: -- Término: IP Pictel Mensaje (0.000000 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: pagofacilde@telefonicaconsumerfinance.net --
    Mon 2023-01-23 11:38:21: -- Término: pagofacilde@telefonicaconsumerfinance.net (0.000000 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: Domain: commcenter.es - Anti-Virus --
    Mon 2023-01-23 11:38:21: Procesando el mensaje con el anti-virus (Tamaño: 96999)...
    Mon 2023-01-23 11:38:21: * Escaneando el mensaje utilizando: ClamAV for SecurityGateway
    Mon 2023-01-23 11:38:21: * Mensaje limpio (no se encontraron virus)
    Mon 2023-01-23 11:38:21: * Escaneando el mensaje utilizando: Cyren Anti-Virus for SecurityGateway
    Mon 2023-01-23 11:38:21: * Escaneo de mensaje fallido
    Mon 2023-01-23 11:38:21: ** Fileinto admin
    Mon 2023-01-23 11:38:21: -- Término: Domain: commcenter.es - Anti-Virus (0.838861 segundos) --
    Mon 2023-01-23 11:38:21: -- Ejecutando: Domain: commcenter.es - Outbreak Protection (Anti-Virus) --
    Mon 2023-01-23 11:38:21: Procesando el mensaje con Outbreak Protection (Tamaño: 96999)…
    Mon 2023-01-23 11:38:22: * Reference-ID: str=0001.0A782F1A.63CE639E.004D,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
    Mon 2023-01-23 11:38:22: * Nivel de amenaza de Spam: Clean
    Mon 2023-01-23 11:38:22: * Nivel de amenaza del Virus: Clean
    Mon 2023-01-23 11:38:22: -- Término: Domain: commcenter.es - Outbreak Protection (Anti-Virus) (0.629146 segundos) --
    Mon 2023-01-23 11:38:22: -- Ejecutando: Domain: commcenter.es - Outbreak Protection (Spam) --
    Mon 2023-01-23 11:38:22: -- Término: Domain: commcenter.es - Outbreak Protection (Spam) (0.000000 segundos) --
    Mon 2023-01-23 11:38:22: -- Ejecutando: Domain: commcenter.es - DMARC --
    Mon 2023-01-23 11:38:22: Realizando procesamiento DMARC
    Mon 2023-01-23 11:38:22: * File: C:\Program Files\MDaemon Technologies\SecurityGateway\Inbound\39793a9743a94acea88953d702796d5d.MSG
    Mon 2023-01-23 11:38:22: * MessageID: <!&!AAAAAAAAAAAYAAAAAAAAAMdTQ+T623JAtTY4aC2kENXCgAAAEAAAAON5HocrxOFOqrN5pC6cPeYBAAAAAA==@gestisae.net>
    Mon 2023-01-23 11:38:22: * Author domain: gestisae.net
    Mon 2023-01-23 11:38:22: * Organizational domain: gestisae.net
    Mon 2023-01-23 11:38:22: Ejecutando consulta DMARC
    Mon 2023-01-23 11:38:22: * Query domain: _dmarc.gestisae.net
    Mon 2023-01-23 11:38:22: * Policy record: v=DMARC1; p=none; rua=mailto:dmarc@gestisae.net.; ruf=mailto:dmarc@gestisae.net.
    Mon 2023-01-23 11:38:22: * Checking authentication mechanisms for DMARC alignment
    Mon 2023-01-23 11:38:22: * SPF: domain "gestisae.net" passed SPF check; and domain is DMARC aligned
    Mon 2023-01-23 11:38:22: * DKIM: verification disabled by administrator
    Mon 2023-01-23 11:38:22: -- Término: Domain: commcenter.es - DMARC (0.052429 segundos) --
    Mon 2023-01-23 11:38:22: -- Ejecutando: Domain: commcenter.es - Attachment Filtering --
    Mon 2023-01-23 11:38:22: -- Término: Domain: commcenter.es - Attachment Filtering (0.000000 segundos) --
    Mon 2023-01-23 11:38:22: -- Ejecutando: Domain: commcenter.es - salesforce.com --
    Mon 2023-01-23 11:38:22: -- Término: Domain: commcenter.es - salesforce.com (0.000000 segundos) --
    Mon 2023-01-23 11:38:22: -- Ejecutando: Domain: commcenter.es - elevenpaths.com --
    Mon 2023-01-23 11:38:22: -- Término: Domain: commcenter.es - elevenpaths.com (0.000000 segundos) --
    Mon 2023-01-23 11:38:22: -- Ejecutando: Domain: commcenter.es - Commcenter --
    Mon 2023-01-23 11:38:22: -- Término: Domain: commcenter.es - Commcenter (0.000000 segundos) --
    Mon 2023-01-23 11:38:22: -- Ejecutando: Message Score --
    Mon 2023-01-23 11:38:22: -- Término: Message Score (0.000000 segundos) --
    Mon 2023-01-23 11:38:22: * Puntuación final: 0.00
    Mon 2023-01-23 11:38:22: ========== Finalizar DATA scripts
    Mon 2023-01-23 11:38:22: --> 250 Ok, message saved
    Mon 2023-01-23 11:38:22: <-- QUIT
    Mon 2023-01-23 11:38:22: --> 221 See ya in cyberspace
    Mon 2023-01-23 11:38:22: Sesión SMTP exitosa (Bytes entrantes/salientes: 97183/536)
    Mon 2023-01-23 11:38:22: ----------
     

    The error is caused by the filterhost.exe?


  • I have tried to disable the filtering, but it keeps stopping it. I think it's not a problem with filterhost.exe


  • After several tests I have come to the conclusion that the problem is the size of the file that the antivirus scans.

     

    Same file with the difference in size.
    * With few data

    Mon 2023-01-23 16:37:32: Procesando el mensaje con el anti-virus (Tamaño: 20352)...
    Mon 2023-01-23 16:37:32: * Escaneando el mensaje utilizando: ClamAV for SecurityGateway
    Mon 2023-01-23 16:37:33: * Mensaje limpio (no se encontraron virus)
    Mon 2023-01-23 16:37:33: * Escaneando el mensaje utilizando: Cyren Anti-Virus for SecurityGateway
    Mon 2023-01-23 16:37:33: * Mensaje limpio (no se encontraron virus)
    Mon 2023-01-23 16:37:33: -- Término: Domain: commcenter.es - Anti-Virus (0.471859 segundos) --


    with more data (same file)

    Mon 2023-01-23 16:29:06: -- Ejecutando: Domain: commcenter.es - Anti-Virus --
    Mon 2023-01-23 16:29:06: Procesando el mensaje con el anti-virus (Tamaño: 25578)...
    Mon 2023-01-23 16:29:06: * Escaneando el mensaje utilizando: ClamAV for SecurityGateway
    Mon 2023-01-23 16:29:06: * Mensaje limpio (no se encontraron virus)
    Mon 2023-01-23 16:29:06: * Escaneando el mensaje utilizando: Cyren Anti-Virus for SecurityGateway
    Mon 2023-01-23 16:29:06: * Escaneo de mensaje fallido
    Mon 2023-01-23 16:29:06: ** Fileinto admin
    Mon 2023-01-23 16:29:06: -- Término: Domain: commcenter.es - Anti-Virus (0.419430 segundos) --
    Mon 2023-01-23 16:29:06: -- Ejecutando: Domain: commcenter.es - Outbreak Protection (Anti-Virus) --
    Mon 2023-01-23 16:29:06: Procesando el mensaje con Outbreak Protection (Tamaño: 25578)…


    But if in Antivirus settings --> VirusScanning --> Configuration
    Allow message to pass if one Antivirus engine scans successfully

    It is activated, it does not give any error, but we lose the CYREN Antivirus

     

    Mon 2023-01-23 16:40:09: -- Ejecutando: Domain: commcenter.es - Anti-Virus --
    Mon 2023-01-23 16:40:09: Procesando el mensaje con el anti-virus (Tamaño: 32876)...
    Mon 2023-01-23 16:40:09: * Escaneando el mensaje utilizando: ClamAV for SecurityGateway
    Mon 2023-01-23 16:40:09: * Mensaje limpio (no se encontraron virus)
    Mon 2023-01-23 16:40:09: * Escaneando el mensaje utilizando: Cyren Anti-Virus for SecurityGateway
    Mon 2023-01-23 16:40:09: * Escaneo de mensaje fallido
    Mon 2023-01-23 16:40:09: -- Término: Domain: commcenter.es - Anti-Virus (0.157286 segundos) --
    Mon 2023-01-23 16:40:09: -- Ejecutando: Domain: commcenter.es - Outbreak Protection (Anti-Virus) --
    Mon 2023-01-23 16:40:09: Procesando el mensaje con Outbreak Protection (Tamaño: 32876)…
     
    br, 
    Javier Meilan

  • @Bill I emailed you this morning with a new dll to try, please let me know if it fixes the issue for you.


  • @Javier It is not caused by the issues with filterhost.exe.  Please see the thread Filter Error thread you started for a solution for that issue.

    If you can email me privately at arron.caruth@mdaemon.com, I'd be happy to share the dll I provided to Bill so that we can verify if it addresses your issue as well.

     


  • @Arron Hi Arron, I never received the e-mail.


  • @Bill Sorry, the message was quarantined by our server.  I just released the message from the quarantine this morning.  You should have it now, if you do not, let me know and I will resend.


  • @Javier Meilan regarding the iFilter error "LoadIFilter: Unexpected error."

    It looks like you did install the VS 2015 runtime. This error is different but doesn't tell me very much. I would try installing the MS office filter pack on the server.

    https://www.microsoft.com/en-us/download/details.aspx?id=58425


  • @Matthew McDermott This package cannot be installed on the server. It does not allow it.


Please login to reply this topic!