Compressed file scanning
I am trying to figure out why Forefront for exchange is not scanning inside .zip files for inbound mail. I have Forefront configured to block/quarantine .exe files in email. From an outside email account I send an email with a .exe attachment. I then get a message from Forefront saying it has quarantined the email (okay, all good). Now is use WinZip and zip the .exe file. I then send another test email with the .zip file attached. This time the message comes thru and the attachment is replaced by a .txt file which says “The attachment has been removed”. This is exchange ‘attachment filter’ removing the attachment and not Forefront. There is no log in Forefront that I can see, showing if the message was even scanned by Forefront.
I’ve verified the transport-agent settings in exchange ‘FSE Routing Agent’ has priority ‘10’ and ‘Attachment Filter Agent’ priority ‘11’.
My file filters in forefront are as follows:
Filter list named "FileTypeFilter" with *.* in the list. File types selected are 'ani' 'arc' 'arj' 'dataz' 'exe' 'is_uninst' 'iscab' 'jar' 'javaclass' 'mac' 'mscab' 'mslibrary' 'obj' 'pif' 'rar' 'sfxexe' Set to enable with action delete remove contents and 'Send notification' and 'quarantine files' selected.
Second filter list named "Restricted Files" with *.exe* among others in the list. File types are set to 'All Types' The filter is enabled with action set to delete remove contents and 'Send notification' and 'Quarantine Files' selected.
All Replies
- Just to clarify. I've tested several other file types also (not just .exe) and I am getting the same results. Forefront cleans/removes the files without issue unless they are within a container file (.zip).
Have you created an Exchange transport rule to filter out .zip file? From your first post, seems that's the case, since you mentioned agent priority. Transport agent's priority is a relative term, the number is only meaningful when two agents are in the same transport process (For example "SMTP Receive", "Categorizer") and process the same command. In this case, the SMTP agents (Attachment Filtering agent) get processed first in SMTP Receive, while routing agents (in Categorizer) are processed after an e-mail is received by the Exchange organization.
You can try rename the .zip to another extension, for example, .zzz. Exchange transport rule agent can only filter out file by extension name, while Forefront can filter out file by true file type.
