> Source: [sk182701](https://support.checkpoint.com/results/sk/sk182701)

# sk182701 - EXE file downloaded with 0B size despite policy configuration to block it

| Property | Value |
|----------|-------|
| Solution ID | sk182701 |
| Date Created | 2024-09-22 |
| Last Modified | 2024-09-24 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * The system allows the download of an executable (`.exe`) file despite existing policy restrictions, resulting in a download of a 0-byte file.
* The current drop rule is set to redirect to UserCheck upon violation. If you change this rule to only drop the file (without redirection) this resolves the issue.
* A specific rule is in place to drop and redirect files categorized as "Executable."
* Content Awareness debugging confirms that the packet was accurately classified as "Executable" and successfully matched the rule directing to UserCheck. Key debug lines include:

  ```
  
  {engine} dlpda_file_metadata_create_or_update_log_clob: file metadata clob: (0x7fbed3d67e68), ref_count: (2), id: {1-0-0-0}, file_id: '83886105', ancestor_file_id: '0', ancestor_file_name: 'no file name', file_name: 'Example.exe', file_type: 'Executable', file_size: '1624144', direction: 'DOWN';
  {rulebase} up_rulebase_execute_match: [0] 'Network' (0): MATCH 1 Accept;
  {rulebase} up_rulebase_execute_match: [1] 'Applications & Url Filtering' (1): MATCH 37 Redirect;
  Note: In this instance, rule 37 triggers a redirect to UserCheck.
  ```

* It is important to note that this issue does not affect all `.exe` files.

## Cause

The issue is analogous to the root cause identified in [sk102292](https://support.checkpoint.com/results/sk/sk102292). Specifically, data is transmitted to the client prior to the completion of the inspection process. As a result, the system is unable to redirect to UserCheck, leading to the file being downloaded without any content.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content