Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » how to block *.docm attachments
  •  
camisy

Messages: 113
Karma: 12
Send a private message to this user
There is currently an increased spam wave out there sending empty MS word files with file extension .docm. If opened and macros are enabled it will download additional malware.

How can we block *.docm attachments? Could not find a customization on http://kb.kerio.com/product/kerio-connect/server-configurati on/antivirus/filtering-message-attachments-in-kerio-connect- 1160.html
  •  
Pavel Dobry (Kerio)

Messages: 5186
Karma: 245
Send a private message to this user
Type *.docm to the combo box with extension list.

Knowledge Base: http://kb.kerio.com/.
Technical support: http://www.kerio.com/support
------------------
Stay Connected Anytime, Anywhere. Discover Kerio Cloud!
  •  
freakinvibe

Messages: 1487
Karma: 57
Send a private message to this user
We got the same issue, we got some Macro malware (.docm) files. In the Attachment Filter list, you have to Add this extension manually, we have added:

*.docm
*.dotm
*.xlsm
*.xltm
*.potm
*.pptm



Dexion AG - The Blackberry Specialists in Switzerland
http://www.dexionag.ch
  •  
Will Mayall

Messages: 171
Karma: 5
Send a private message to this user
Thanks freakinvibe for that list!
  •  
Pavel Dobry (Kerio)

Messages: 5186
Karma: 245
Send a private message to this user
freakinvibe wrote on Wed, 04 May 2016 16:54
We got the same issue, we got some Macro malware (.docm) files. In the Attachment Filter list, you have to Add this extension manually, we have added:

*.docm
*.dotm
*.xlsm
*.xltm
*.potm
*.pptm




Or just use *.???m Smile

Knowledge Base: http://kb.kerio.com/.
Technical support: http://www.kerio.com/support
------------------
Stay Connected Anytime, Anywhere. Discover Kerio Cloud!
  •  
freakinvibe

Messages: 1487
Karma: 57
Send a private message to this user
You might catch too much, e.g. .xlam and others, that's why I added them separately. But your mileage may vary and the wildcard version is the perfect fit.

Dexion AG - The Blackberry Specialists in Switzerland
http://www.dexionag.ch
  •  
camisy

Messages: 113
Karma: 12
Send a private message to this user
I believe such filters always need to be updated. For now I'm adapting *.???m as filter as this is currently the way macro malware gets distributed.
I'm also blocking .doc files in general but this depends on the country you are (some countries are much more affected than others).
Thanks!

ps: did miss that the field is not only drop down but also customizable A hint in the GUI might help others as well.
Previous Topic: Grid lines barely visible in calendar.
Next Topic: Whitelist IP no longer working
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Mon Mar 27 22:21:46 CEST 2017

Total time taken to generate the page: 0.00957 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.