Email AV issue

Kurtish99 · 03-30-2011, 06:28 AM

I just noticed something unusual about email SPAM filtering and virus protection.. If a message comes in (I had two yesterday - the "UPS package delivery notification" emails that contain viruses to install the droppers for the fake-AV crap) and is QUARANTINED as SPAM or Phishing - the malicious attachments aren't stripped off (or scanned as it appears, since I have the Kapersky app set to BLOCK messages that contain viruses).. if a user releases them from the quarantine - BAM - virus containing email makes it through to their Outlook client.. any ideas on how to remedy this?

hlarsen · 03-30-2011, 11:54 AM

have you tried scanning the attachment that makes it through? i just talked to another user who noticed the same thing, but he said the attachment came up clean when scanning it after delivery.

regardless, this is something we'll be looking into.

Kurtish99 · 03-30-2011, 03:32 PM

I didn't scan it to be honest - but I will and let you know what I find..

Danp · 03-30-2011, 08:08 PM

I had a similar issue recently. The attachment was a RAR file that ended up in quarantine. It was one of those UPS-style emails, so I'm sure that whatever it contained was not something I wanted running around my network. :-)

Kurtish99 · 03-31-2011, 07:12 AM

I have saved the attachment ZIP file and scanned with Microsoft security Essentials and Kaspersky - both confirm that is contains a virus..

dwasserman · 03-31-2011, 11:29 AM

I have one UPS mail tagged as [virus] in my pop3inbox, and no attachments.

virus mail1.jpg

03-30-2011, 06:28 AM	#1 (permalink)
Kurtish99 Untangler Join Date: Jan 2010 Location: Cape Coral, FL Posts: 36	Email AV issue I just noticed something unusual about email SPAM filtering and virus protection.. If a message comes in (I had two yesterday - the "UPS package delivery notification" emails that contain viruses to install the droppers for the fake-AV crap) and is QUARANTINED as SPAM or Phishing - the malicious attachments aren't stripped off (or scanned as it appears, since I have the Kapersky app set to BLOCK messages that contain viruses).. if a user releases them from the quarantine - BAM - virus containing email makes it through to their Outlook client.. any ideas on how to remedy this?

03-30-2011, 11:54 AM	#2 (permalink)
hlarsen Join Date: Jul 2010 Location: sfba URLs submitted: 1 Posts: 1,139	have you tried scanning the attachment that makes it through? i just talked to another user who noticed the same thing, but he said the attachment came up clean when scanning it after delivery. regardless, this is something we'll be looking into. __________________ Attention: Support on the Untangle Forums is provided by volunteers and community members. If you need official Untangle support please call or email support@untangle.com.

03-31-2011, 11:29 AM	#6 (permalink)
dwasserman Join Date: Jun 2008 Location: Argentina URLs submitted: 57 Posts: 3,634	I have one UPS mail tagged as [virus] in my pop3inbox, and no attachments. virus mail1.jpg __________________ The world is divided into 10 kinds of people, who know binary and those not

Protect

Filter

Perform

Connect

Manage

Add-Ons

03-30-2011, 03:32 PM	#3 (permalink)
Kurtish99 Untangler Join Date: Jan 2010 Location: Cape Coral, FL Posts: 36	I didn't scan it to be honest - but I will and let you know what I find..

03-30-2011, 08:08 PM	#4 (permalink)
Danp Master Untangler Join Date: Aug 2008 URLs submitted: 2 Posts: 442	I had a similar issue recently. The attachment was a RAR file that ended up in quarantine. It was one of those UPS-style emails, so I'm sure that whatever it contained was not something I wanted running around my network. :-)

03-31-2011, 07:12 AM	#5 (permalink)
Kurtish99 Untangler Join Date: Jan 2010 Location: Cape Coral, FL Posts: 36	I have saved the attachment ZIP file and scanned with Microsoft security Essentials and Kaspersky - both confirm that is contains a virus..