Malware 'Unscannable' was detected

Hello tstan,

Thank you for contacting the Sophos Community.

Checking with labs, the website is categorized as Computing & Internet, and or IT.

Has this issue resurfaced since you opened the thread?

If this still happens and to know if it is a false positive we would need to do a packet capture to submit to Labs, if that website is yours or you know that website you could create an exception in the SWA and XG for not scanning. 

XG

Protect >> Web >> Exceptions >> Add

SWA

Configuration >> Group Policy >> Local Site List >> Add site

If you want to do the packet capture, please send me a PM, we would need it for both the XG and SWA.

Regards,

Hi, 

thanks for the reply.

I have also found this link, 

https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/3354/lumension

would you think this is related to my question? 

regards

Hello Tstan,

Thank you for the follow-up.

Yes, I investigate a bit more and it seems Lumension is our Sophos Technology partner for the Patch capability. I am from the Firewall team so not very familiar with endpoint. 

So if you could create the exceptions I mentioned it should solve the issue, it does seem like they are false positives. 

Also, it is recommended to have the following exception in the SWA and the XG.

http://sophos.cdn.lumension.com/sophos/

(^[A-Za-z0-9.-]*\.sophos\.cdn\.lumension\.com/

http://sophos.cdn.heatsoftware.com/sophos/

^[A-Za-z0-9.-]*\.sophos\.cdn\.heatsoftware\.com/

Regards,

Hi, thanks for checking this, I will add these exceptions and get back to you.

best regards

Hi, 

after adding the exceptions that you found and monitoring it for the past week, we have had no more log entries for the "Malware unscannable message" for this site so it looks to have been successful.

Thanks for your help with this.

best regards

Hi, 

after adding the exceptions that you found and monitoring it for the past week, we have had no more log entries for the "Malware unscannable message" for this site so it looks to have been successful.

Thanks for your help with this.

best regards

Hello Tstan,

Thank you for the follow-up.

You are welcome! I have sent you a PM if you have 7 seconds to check it I would appreciate it. 

Regards,