"Malware 'Unscannable' was detected and blocked in a download from ocsp.digicert.com"

Question

Hello and have a nice day 
 we had a short power failure yesterday and since then I have this error message in the event log every second: 
 
 messageid="08001" message="Malware 'Unscannable' was detected and blocked in a download from ocsp.digicert.com" log_type="Anti-Virus" log_component="HTTP" log_subtype="Virus" status="" fw_rule_id="16" user="" web_policy_id="0" policy_name="" virus="Unscannable" url="http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D" domain="ocsp.digicert.com" src_ip="192.168.100.35" src_country="R1" dst_ip="93.184.220.29" dst_country="GBR" protocol="TCP" src_port="50781" dst_port="80" bytes_sent="279" bytes_received="799" user_agent="Microsoft-CryptoAPI/10.0" status_code="500" 
messageid="08001" message="Malware 'Unscannable' was detected and blocked in a download from crl4.digicert.com" log_type="Anti-Virus" log_component="HTTP" log_subtype="Virus" status="" fw_rule_id="16" user="" web_policy_id="0" policy_name="" virus="Unscannable" url="http://crl4.digicert.com/DigiCertGlobalRootG2.crl" domain="crl4.digicert.com" src_ip="192.168.100.35" src_country="R1" dst_ip="93.184.220.29" dst_country="GBR" protocol="TCP" src_port="50429" dst_port="80" bytes_sent="181" bytes_received="1147" user_agent="Microsoft-CryptoAPI/10.0" status_code="500" 
messageid="08001" message="Malware 'Unscannable' was detected and blocked in a download from crl3.digicert.com" log_type="Anti-Virus" log_component="HTTP" log_subtype="Virus" status="" fw_rule_id="16" user="" web_policy_id="16" policy_name="" virus="Unscannable" url="http://crl3.digicert.com/DigiCertGlobalRootG2.crl" domain="crl3.digicert.com" src_ip="192.168.100.35" src_country="R1" dst_ip="93.184.220.29" dst_country="GBR" protocol="TCP" src_port="49770" dst_port="80" bytes_sent="181" bytes_received="1147" user_agent="Microsoft-CryptoAPI/10.0" status_code="500" 
 Also, incoming mails are no longer scanned for viruses and spam protection does not work anymore. 
 For the time being I have set the protection on scan failure to 'Allow' and also had to deactivate the caching, so that I don't get any more error messages for the time being. 
 
 With best regards

Dean Andeselic · Accepted Answer

I followed the link and ran this: 
 Sophos AV update failed - broken all web access when malware enabled - This keeps happening 
 "mv /content/u2d/pattern /content/u2d/pattern.org This will rename the pattern file to pattern.org. Now update the pattern files with the GUI using System > Administration > Updates. Give the firewall some time to succeed the update process." 
 From the thread. 
 It worked for me last time without break XG. 
 then I reactivated the virus protection and tested it. Emails and websites could be opened normally again.

LHerzog · Answer

To me this reads like the AV definitions have been updated maybe at the time the outage happened and are now corrupted. 
 Have you just tried to stop and restart AV service? 
 I think it would be too easy to stop the Service, delete them and let it download the patterns again. Probably something for tech support but you coul dtry what's beeing discussed here: community.sophos.com/.../sophos-av-update-failed---broken-all-web-access-when-malware-enabled---this-keeps-happening

"Malware 'Unscannable' was detected and blocked in a download from ocsp.digicert.com"

Top Replies