Logout

Alt-N Discussion Groups > MDaemon Discussion Groups > MDaemon Content Filter > Macro Viruses in Word and Excel documents

 [F] Alt-N Discussion Groups  / MDaemon Discussion Groups  / MDaemon Content Filter  /

Macro Viruses in Word and Excel documents

[Clark, Chris]
Chris Clark
Newbie
Newbie
Posts: 11
Chris Clark - 06:27am, Jun 17 2015

I'm finding that even with MDaemon 15.0.1 and SecurityPlus 4.5.0 quite a lot of emails with macro viruses in the Office file attachments are still getting through undetected.

I wondered if it was possible to use Content Filter to block any word/excel attachment which contained a macro or if there was some other way around the problem.

Chris

  (older msg: 11)All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items

Arron Caruth (apparently) - Jun 22, 2015 8:08 pm (#12 Total: 12)  

via email  

Photo of Author
Arron Caruth
Administrator
Administrator
Posts: 1686
[md-cfilter] Macro Viruses in Word and Excel documents

VirusTotal.com is now reporting that Kaspersky is detecting the file as a virus.  Is SecurityPlus catching it on your system now?

 

-- 

Arron Caruth
Director of Product Development
Alt-N Technologies
http://www.altn.com
 

Sent using Alt-N's own MDaemon Messaging Server   
Now available with  BYOD Mobile Device Management, 
Document Sharing, Hijacked Account Detection and more.

Get to know the Alt-N family by liking us on Facebook!

 

From: md-cfilter@altn.com [mailto:md-cfilter@altn.com] On Behalf Of Arron Caruth
Sent: Thursday, June 18, 2015 9:30 PM
To: md-cfilter List Member
Subject: [md-cfilter] Macro Viruses in Word and Excel documents

 

According to VirusTotal.com most AV products, including Kaspersky, are not detecting the file as infected. 

 

https://www.virustotal.com/en/file/4d7392fb310d2c33b7706b9dfda6f2307dae9ba49a88081957a02e6c01777b89/analysis/1434659740/

 

I could setup a test as you’ve described, but after a week if it still wasn’t being caught my first step would be to submit the file to Kaspersky.

 

While not impossible, it is unlikely that this macro virus isn’t being caught because of how the Kaspersky engine is integrated into SecurityPlus.

 

-- 

Arron Caruth
Director of Product Development
Alt-N Technologies
http://www.altn.com
 

Sent using Alt-N's own MDaemon Messaging Server   
Now available with  BYOD Mobile Device Management, 
Document Sharing, Hijacked Account Detection and more.

Get to know the Alt-N family by liking us on Facebook!

 

From: md-cfilter@altn.com [mailto:md-cfilter@altn.com] On Behalf Of Chris Clark
Sent: Thursday, June 18, 2015 6:18 PM
To: md-cfilter List Member
Subject: [md-cfilter] Macro Viruses in Word and Excel documents

 

Arron,

I had a hard time getting the infected file inside a ZIP file because Microsoft Security Essentials on my PC knew it was malicious and kept preventing me. To me this indicates that it is not such a new virus that the antivirus products haven't been updated to detect this yet and I suspect that a Kaspersky product installed on a desktop PC would also pick it up.
Are you sure that there isn't some problem in the way Kaspersky is integrated with SecurityPlus?
You could keep sending an email with that file as an attachment through a test installation of MDaemon in a similar way that the Eicar virus is used as a test. If, say, in a week's time it still isn't picking it up then it can't just be that the antivirus definitions haven't been updated.

Thanks for your help with this.

Chris


View/reply at Macro Viruses in Word and Excel documents

 
 
--MD-CFILTER---------------------------------------------------------
This list is for questions and discussions about MDAEMON's Content 
Filter. To unsubscribe from this mailing list send an email to 
md-cfilter-unsubscribe@altn.com .
--POWERED BY MDAEMON!------------------------------------------------
 
---------------------------------------------------------------------
These forums are provided by Alt-N Technologies for user-to-user 
support and discussion.  Alt-N staff members may participate in the 
forums periodically but please recognize that this is not the official
method of receiving technical support. To receive personal technical 
support please use the form here:
http://www.altn.com/Support/RequestSupport/
---------------------------------------------------------------------

--MD-CFILTER---------------------------------------------------------
This list is for questions and discussions about MDAEMON's Content
Filter. To unsubscribe from this mailing list send an email to
md-cfilter-unsubscribe@altn.com .
--POWERED BY MDAEMON!------------------------------------------------

---------------------------------------------------------------------
These forums are provided by Alt-N Technologies for user-to-user
support and discussion.  Alt-N staff members may participate in the
forums periodically but please recognize that this is not the official
method of receiving technical support. To receive personal technical
support please use the form here:
http://www.altn.com/Support/RequestSupport/
---------------------------------------------------------------------



  All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items



 Content:

Read New | Search

 Guest:

Email to Admin



You are visiting as a Guest user.