• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2255
  • Last Modified:

Exchange Server 2003 rejecting emails containing VBA macros

Another user asked a question about the error "552 ms-office file containing VBA macros" back on the 7th of March, but the answer was not sufficient.

My server is rejecting incoming messages that contain Excel files and the sender gets the same message you see above, but I can't find out where that is configured or enabled on my server.

I have Exchange 2003, Symantec Enterprise with the Exchange add-on, and a Sonicwall firewall.

The Sonicwall is configured to reject VBS ant EXE attachments, but the message generated would be something else.

The Symantec scans for viruses, but should quarantine the attachment and still let the message through to the recipient with a warning message.

I see nothing in Exchange 2003 that would reject messages because of VBA scripts inside an attachment.

I need to get this fixed immediately. Tax season is a lousy time for users to scream at an accounting firm.
0
perrytcpa
Asked:
perrytcpa
  • 3
  • 2
  • 2
  • +1
2 Solutions
 
Irwin SantosComputer Integration SpecialistCommented:
double check your Symantec configuration.
0
 
perrytcpaAuthor Commented:
Did that already, as described.
0
 
Irwin SantosComputer Integration SpecialistCommented:
would it be feasible for you to turn off the Symantec service for testing so that you can send an Excel attachment from an outside email.. such as your client or maybe even create a homail account to do so?  If you get the same results with Symantec off. .then we look elsewhere.. if on, then it is in the configuration preventing the transport of the XLS file.
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
perrytcpaAuthor Commented:
If I can get a copy of the XLS file, then I can try disabling the auto-protect. I don't think it will help, because Symantec doesn't BLOCK messages from being received by the mail server - it only quarantines the message then warns the recipient that a message had an attachment that wasn't allowed. It does the same thing with content filtering as it scans for messages about viagra and penis enlargers.

But I'm willing to give it a shot just to rule out the Symantec being the cause. It was the first thing I checked, but I know I have to try to rule it out.

In the meantime, what could cause a bounce message that says,  "552 ms-office file containing VBA macros" ? It seems like an Exchange generated message, like the familiar "550 Relay not allowed" message.

I'll get back after I find the offending file and try it.
0
 
cj_1969Commented:
I did a quick search ... it looks like this is your firewall doing this ... check out this ...
http://www.sonicwall.com/support/pdfs/SonicWALL_GAV_AdminGuide.pdf

queue, thus preventing it from being resent, via 552 SMTP response and the ... Restrict Transfer of MS-Office type files containing macros (VBA 5 and above) ...
www.sonicwall.com/support/ pdfs/SonicWALL_GAV_AdminGuide.pdf - Similar pages
0
 
perrytcpaAuthor Commented:
cj_1969,

Concerning the sonicwall Admin Guide - I downloaded it and searched for 552 SMTP and only got one refernce. It didn't seem to apply.

Your response seemed a little disjointed, as if your cut and paste didn't work as you expected. Were you trying to point me to a specific page or solution?
0
 
IPKON_NetworksCommented:
I think cj_1969 was pointing you to the manual for SonicWall which relates to the restrict transfer settings listed under the Configure Gateway AV Settings button in the Gateway Anti-Virus Global Settings section. If enabled, prevent files with specific attributes from being transferred to SMTP. This includes VBA for Macros in Office 97 and above.

Uncheck this box and see if that helps. The message certainly looks like a SonicWall error. You should see this in the SonicWall logs (assuming you are trapping to informational status).

Hope this helps
Barny
IPKON Networks Ltd
0
 
cj_1969Commented:
Sorry for the disjointed reply ... the second part was the search results summary, this indicated, as pointed out by IPKON, that the firewall has the settings for blocking exactly what you claimed was happening, and it showed the exact error number that you were seeing ... put the two together and it was apparent that there is an option in the firewall that is causing the problem, especially since none of the other pieces are known to have this specific functionality and produce this exact result.  

And then IPKON pointed out the specific settings that should be causing the problem.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 3
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now