This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG 18.0.4 MR4 - MTA SAV misses virus: Mal/Generic-S, CXmail/MalPE-BV

Behind the XG with MTA we are still running Puremessage. Puremessage is EOL and the virus and spam definitions are no longer updated. Still the XG with the latest definitions does not recognize an attachment that was identified by Puremessage as:

Virus infection detected
Location: Consignment Document.gz
Replaced with text: Yes
Virus name(s): Mal/Generic-S, CXmail/MalPE-BV

This thread was automatically locked due to age.

0 emmosophos over 3 years ago

Hello Fred,

Thank you for contacting the Sophos Community.

Please, submit the sample using this link.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Fred_B over 3 years ago in reply to emmosophos

It was replaced with text by Puremessage. Puremessage spam and virus definitions ended 2020.

The XG is uptodate and checks at a 2 hourly interval. General setting malware scanning is set to Sophos. Mail policy is set to use dual scanning. It is ofcourse set to scan in and outgoing email. The e-mail rules also have Smtp and Smtps enabled. Stilll it was cleared by the XG and delivered to Puremessage that detetected as viral based on an outofdate definition database.
Cancel
Vote Up 0 Vote Down

Cancel
0 Fred_B over 3 years ago in reply to Fred_B

I have created case 03694098 for this.

I was able to find the .eml file. The .gz file within this .eml file containing the virus is not detected by Endpoint X either. It is only found by Puremessage scanning the mailbox.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 3 years ago in reply to Fred_B

Hello Fred,

Thank you for the Case ID.

The email you used to submit the sample in the Web Site is the same you use in the Portal?

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Fred_B over 3 years ago in reply to emmosophos

How do you mean? This eml file submitted in the case is the same email received tru the XG.

The XG is set to drop on malware detection.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 3 years ago in reply to Fred_B

Hello Fred,

Sorry I meant to say, the email address you used to submit the sample, not the email itself.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Fred_B over 3 years ago in reply to emmosophos

Hi Emmanuel,

i used the Sophos website to upload the sample as a file to this case.
Cancel
Vote Up 0 Vote Down

Cancel