Try the following steps:

• Create a new file called badExtensions.txt in $INSTALL_DIR\config folder
• Add comma-separated extensions that you want to block. The default value is set to:
  
  .scr,.pif,.js,.html,.htm,.bin,.com,.vbs,.wsf,.hta,.jse,.bat,.cmd,.jar,.exe
  
  
• You can add/remove any extension you like
• Save the file and restart Xeams