Virus attack my mail OLETOOLS_FAIL

Recently our nethserver 7 was attack by Spam and Virus. I’d check Rspam/History found as bellowing

MIME_GOOD (-0.1) [multipart/mixed]
IP_REPUTATION_HAM (0) [asn: 36351(-0.30), country: US(-0.01), ip:]
ASN (0) [asn:36351, ipnet:, country:US]
HAS_X_GMSV (0) []
R_SPF_ALLOW (0) [+a]
HAS_X_AS (0) []
GREYLIST (0) [pass,body]
NEURAL_SPAM (0) [1.488]
DMARC_NA (0) []
OLETOOLS_FAIL (0) [failed to scan, maximum retransmits exceed - err: RETURN_PARSE_ERROR]
MIME_TRACE (0) [0:+,1:~,2:~]

And there are attached file as “somefilename.doc” which inflect virus.
Would you help advise how to fix this

I have also noticed that many times emails with office attachments containing viruses pass the rspamd/oletools filter with the same error.

I have “solved” by rejecting all office documents and sending an email reply to send the documents or compressed or deposit them on the corporate NextCloud
I did not do it on Nethserver but with a script on “hmailserver mail server” interposed in the mail flow.

Thanks @saitobenkei In that case what about simple Doc, Xls that is no macro? Can we received them?

No matter what the file contains, if it is an office document it is rejected in any case with an email warning both to the sender and to the recipient, unless the sender or the sender’s domain is in whitelist.

It is time to start educating people not to send office documents as email attachments without compressing them or turning them into PDFs.

If it were up to me the emails would still be in pure text format without attachments…

1 Like

I found @stephdl ever post in this link
Expected behavior
When you use a TCP socket, Rspamd expects that the service could not be reachable, then if the Clamd service does not answer, the SYMBOL CLAM_VIRUS_FAIL is added (this symbol can be used to do a force_action after). But when Rspamd cannot connect to the Unix socket of Clamd, apart a maillog warning, nothing is done.

We would like to make a soft reject of emails if Rspamd cannot contact Clamd, this is our security mail policy.

The simple workaround is to use now a TCP socket with Clamd, but we wonder if it is not an issue to fix, for example if Postfix cannot use the Unix socket of Rspamd, the policy is to soft reject all received emails.

Any help appreciated,
I’m using
NethServer release 7.8.2003 (final)
rspamd 2.2
ClamAV 1.5.1

Below is rspamd.conf

[root@mail ~]# cat /etc/clamd.d/rspamd.conf
# Use system logger.
LogSyslog yes

# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
LogFacility LOG_MAIL

# This option allows you to save a process identifier of the listening
# daemon (main thread).
PidFile /var/run/clamd@rspamd/

# Remove stale socket after unclean shutdown.
# Default: disabled
FixStaleSocket yes

# Run as a selected user (clamd must be started by root).
User _rspamd

# Path to a local socket file the daemon will listen on.
LocalSocket /var/run/clamd@rspamd/clamav

#restrict permission
LocalSocketMode 770

Sorry I do not understand the issue, IIRC when the clamav socket is not available then we already softreject the email, except if the sender is know on the server (EG, a user is using the server smtp to send an email)

I’m working on a new olefy RPM version. Would you like to test it?

No problems found since yesterday here…

1 Like

Thanks @davidep.
Anyway before that I just update Clam and. Kernel patches seems to detect OLE.

And Today 20200913 12:59 GMT + 7. (Start from 1:49 GMT + 7)
I Found Spam attack Mail Server (See Pic). And I don’t know How to stop it.