How to block .doc files with dangerous macros inside

[nick]

dear all,

anyone know how I can block the .doc files that have dangerous visual basic inside? What's the correct syntax in "What objects" rules?

Thank you!

 

[tom]

you can block doc files, also doc files inside archives.

you cannot detect just only doc files with dangerous code inside with what objects, this is only possible with virus scanners, detecting a virus/trojan.

 

[nick]

But, this option it's not available in PMG? The engine included in PMG it's not capable to detect this kind of objects? It's impossible to block MO file extensions...
We can't install different antivirus engines?

 

[tom]

But, this option it's not available in PMG?

Which option do you mean exactly?

The engine included in PMG it's not capable to detect this kind of objects?

ClamAV can detect a lot of them. You can also add additional ClamAV databases, e.g.

https://www.securiteinfo.com/servic...on-rate-of-zero-day-malwares-for-clamav.shtml

It's impossible to block MO file extensions...

Why not? What is not working?

We can't install different antivirus engines?

Currently you can install/enable Avast as additional scanner.

 

[nick]

Right now, almost all Office files (doc or xls) attached in spam mails arrive in mailboxes and are blocked by local antivirus if users try to open them. So, they pass trough PMG with no problems. ClamAV detect viruses, but not all of them! I will analyse the option with Avast

 

[nick]

Currently you can install/enable Avast as additional scanner.

How I can install AVAST? I do not see this option

 

[dietmar]

How I can install AVAST? I do not see this option

see https://support.avast.com/en-au/article/131/

 

[Davide Bozzelli]

How I can install AVAST? I do not see this option

Basically:
1) install avast
2) install trial key
3) enable avast support in pmg: pmgsh set /config/admin --avast 1
4) try send an eicar.com test virus: pmg marks it as eicar (avast)

Please remember that you should buy a real license in order to have a working solution.

 

[Juliano Silva]

Hello

How do I create, DatabaseCustomURL ?
DatabaseCustomURL http://www.securiteinfo.com/get/sig...79550a27c2426bf0d06b66030b72/securiteinfo.hdb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...9550a27c2426bf0d06b66030b72/securiteinfo.ign2
DatabaseCustomURL http://www.securiteinfo.com/get/sig...1779550a27c2426bf0d06b66030b72/javascript.ndb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...550a27c2426bf0d06b66030b72/spam_marketing.ndb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...0a27c2426bf0d06b66030b72/securiteinfohtml.hdb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...a27c2426bf0d06b66030b72/securiteinfoascii.hdb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...7c2426bf0d06b66030b72/securiteinfoandroid.hdb

 

[Davide Bozzelli]

Hello

How do I create, DatabaseCustomURL ?
DatabaseCustomURL http://www.securiteinfo.com/get/sig...79550a27c2426bf0d06b66030b72/securiteinfo.hdb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...9550a27c2426bf0d06b66030b72/securiteinfo.ign2
DatabaseCustomURL http://www.securiteinfo.com/get/sig...1779550a27c2426bf0d06b66030b72/javascript.ndb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...550a27c2426bf0d06b66030b72/spam_marketing.ndb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...0a27c2426bf0d06b66030b72/securiteinfohtml.hdb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...a27c2426bf0d06b66030b72/securiteinfoascii.hdb
DatabaseCustomURL http://www.securiteinfo.com/get/sig...7c2426bf0d06b66030b72/securiteinfoandroid.hdb

Use https://github.com/extremeshok/clamav-unofficial-sigs

 

[matze1]

There's a Debian Package available native via apt:

clamav-unofficial-sigs:
Installed: (none)
Candidate: 3.7.2-2
Version table:
3.7.2-2 500
500 http://deb.debian.org/debian stretch/main amd64 Packages

# apt-get install clamav-unofficial-sigs

 

[Davide Bozzelli]

It's very old, i suggest the newest one from github repo