1 Topic by davids355

  • davids355
  • Member
  • Offline
  • Registered: 2025-03-05
  • Posts: 2

Topic: Apple numbers spreadsheet being blocked by virus scanner

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.6.8
- Deployed with iRedMail Easy or the downloadable installer? downloadable installer.
- Linux/BSD distribution name and version:  Ubuntu 22.04.3 LTS
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MariaDB
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No.
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I found that iredmail or amavisd seems to be blocking emails that have Apple numbers files attached. Here is the line from log file relating to the issue -

amavis[1624122]: (1624122-11) Blocked BANNED (.exe,ViewState.iwa) {DiscardedInbound,Quarantined}, [REMOVED]:58518 [REMOVED] ESMTP/ESMTP <REMOVED> -> <REMOVED>, (ESMTPS://[REMOVED]:58518), quarantine: R-iLo8arbgcG, Queue-ID: 4Z6jXk6mnSz2xH3, Message-ID: <REMOVED>, mail_id: R-iLo8arbgcG, b: t5lQx8lEa, Hits: -, size: 1005581, Subject: "test please ignore", From: <REMOVED> (dkim:AUTHOR), helo=REMOVED, b.key=(?^mix:T=(9|386|LeChiffre|aaa|abc|aepl|ani|aru|atm|aut|b64|bat|bhx|bkd|blf|bll|bmw|boo|bps|bqf|breaking_bad|buk|bup|bxz|cc|ccc|ce0|ceo|cfxxe|chm|cih|cla|class|cmd|com|cpl|crinf|crjoker|crypt|cryptolocker|cryptowall|ctbl|cxq|cyw|dbd|delf|dev|dlb|dli|dll|dllx|dom|drv|dx|dxz|dyv|dyz|ecc|exe|exe-ms|exe1|exe_renamed|exx|ezt|ezz|fag|fjl|fnr|fuj|good|gzquar|hlp|hlw|hqx|hsq|hts|iva|iws|jar|js|kcd|keybtc@inbox_com|let|lik|lkh|lnk|locky|lok|lol!|lpaq5|...

I checked and the numbers attachment is technically a compressed file (filename.numbers), when I extract it, it contains quite a few files including ViewState.iwa referenced in the above error log. I scanned the original numbers file, and the viewstate file with virustotal.com and it comes back clean so I think its a false positive but I dont know how to get around this issue.

Can you guys help?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by Neovana

  • Neovana
  • Member
  • Offline
  • Registered: 2023-05-10
  • Posts: 58

Re: Apple numbers spreadsheet being blocked by virus scanner

For the record, I send lots of Apple Numbers Spreadsheet files as attachments in emails and I don't have any issues. What version of numbers are you running? Current is version 14.3 (7042.0.76)

The files that I send are just named like "this is a spreadsheet.numbers". Are you using any special characters in your filenames?

What email client are you using to send the emails?

If you right click on the file and choose "Compress this is a spreadsheet.numbers" and email the resulting .zip file, do you still have the blocking issue?

Can you email other attachments from your email client, like a "this is a photo.jpg" or "this is a text file.txt"?

3 Reply by davids355

  • davids355
  • Member
  • Offline
  • Registered: 2025-03-05
  • Posts: 2

Re: Apple numbers spreadsheet being blocked by virus scanner

Neovana wrote:

For the record, I send lots of Apple Numbers Spreadsheet files as attachments in emails and I don't have any issues. What version of numbers are you running? Current is version 14.3 (7042.0.76)

The files that I send are just named like "this is a spreadsheet.numbers". Are you using any special characters in your filenames?

What email client are you using to send the emails?

If you right click on the file and choose "Compress this is a spreadsheet.numbers" and email the resulting .zip file, do you still have the blocking issue?

Can you email other attachments from your email client, like a "this is a photo.jpg" or "this is a text file.txt"?

Thanks for taking the time to reply. I compressed the file and sent it, but it was still blocked.

I then sent a blank numbers file and exactly as you suggested, it was received without issue.

I then copied the contents of the original file into a new numbers file, sent that and its received without issue.

So I guess there was something about the original file that was being caught by the virus scanner; maybe a false positive or maybe it does contain a virus, although virustotal did not detect anything.

Anyway, thanks for your help :-)