Urgent:Amavisd or ClamD not blocked .exe files when change it to .pdf or .txt

[Dino Edwards]

Attach your amavis conf file please. Are you blocking .exe files in your config? How does the file(1) utility detect said files? Amavis relies on that utility to determine file types. If file(1) is not working correctly in your system it will not block those files. Copy the file to your system and run the following command:

file example.pdf

For instance, I took the executable AeroAdmin.exe and renamed it to AeroAdmin.pdf and ran the following command:

file AeroAdmin.pdf

It got correctly identified as an executable, see below:

AeroAdmin.pdf: PE32 executable (GUI) Intel 80386, for MS Windows



----------------
Dino Edwards
Web: https://www.deeztek.com<https://www.deeztek.com/>
----------------
[hermes_logo3]
Hermes Secure Email Gateway
Hermes Secure Email Gateway is a Free Open Source (Hermes SEG Community Only) Email Gateway that provides Spam, Virus and Malware protection, full in-transit and at-rest email encryption as well as email archiving. Hermes Secure Email Gateway combines Open Source technologies such as Postfix, Apache SpamAssassin, ClamAV, Amavisd-new and CipherMail under one unified web based Web GUI for easy administration and management of your incoming and ougoing email for your organization. It can be deployed to protect your in-house email solution as well as cloud email solutions such as Google Mail and Microsoft Office 365.

Learn More & Download the free open-source appliance at:
https://www.deeztek.com/hermes-secure-email-gateway/









From: amavis-users [mailto:amavis-users-bounces+dino.edwards=mydirectmail.net at amavis.org] On Behalf Of Razmik Baghdasaryan
Sent: Sunday, November 5, 2017 4:26 PM
To: amavis-users at amavis.org
Subject: Urgent:Amavisd or ClamD not blocked .exe files when change it to .pdf or .txt

URGENT WHO CAN HELP ME ?????????

Hello Dear all,
I want to test my Zimbra Mail server and change some example.exe file into example.pdf or example.txt and send email into my gmail account and zimbra account

Gmail detect that in pdf file header have .exe file and block it but Zimbra received it normally

P.S. Our old MailServer (Only Postfix +MailScanner detect it also )

In my mind it is problem!!!
How can I block that type of files ? In my mind it's amavisd or clamd problem who can help me with configuration ?
it is Urgent for me Please help

Thanks In Advance
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20171105/0f223631/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1921 bytes
Desc: image001.jpg
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20171105/0f223631/attachment.jpg>