Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 27 subscribers
  • Views 1486 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG 18.04 MR-4 more malware in emails missed even with Sandstorm now enabled!

Fred_B

After consulting the Sophos reseller we added the extra layer of protection of a Sophos Sandbox subscription.

I now have two additional MALWARE E-MAILS that ended up in the quarentine queue that based on the XG settings should have been dropped. Piuremessage with old definitions identifies them as Mal/Generic-S, Mal/DrodRar-AIC and Mal/Generic-S, Mal/Inject-GM, CXmail/MalPE-B.

XG MTA with SAV DUAL SCAN engine, primary set to Sophos and DETECT ZERO DAY threats with SANDSTORM ENABLED does not detect the malware in these e-mails. In my understanding e-mails that is still being scanned for malware not yet given the all green from both SAV scanning and Sandstrom should not be in the quarantine queue.

Support is not really responding other than sending their default e-mails with instructions to upload the file, My answer again and again is that the fille requested is in the online case portal already uploaded there.

These two new emails are now uploaded also and the case record updated.

The case number is 03694098.

Fred



This thread was automatically locked due to age.
Parents
  • 0

    Hello Fred,

    Thank you for contacting the Sophos Community.

    I was able to find the Samples submitted via the Web Site under Case ID 03741758, I took the samples and made the submissions to Labs, and I raised a Labs request with them.

    I have left a note in your case, for the engineer, once there is an update from Labs, I will ask the engineer to share it with you. 

    In the future, after you submit the samples, share the Case ID  that gets automatically created via the Sample Submission website, in the ticket, so the engineer can open the ticket with Labs using that Case ID, just as you mentioned in the last email.

    Regards,

  • 0 in reply to emmosophos

    Hello Fred,

    An update from Labs.

    There’s a detection for all the samples, except for 2 which are recently created, they’ll be published in the next IDE update.

    Regards,

Reply Children
  • 0 in reply to emmosophos

    Emmanuel,

    Puremessage for Exchange retired as of December 31th but still detects them but XG with Sandbox does not. This tells me that there is something not right with your answer. 

    Are you saying that Puremessage and SAV are using different virus definitions as compared to XG and Sandstorm? It is supposed to have a dual scan engine. I can send more samples that are detected by Puremessage proving the old product to be superior over XG and Sandstorm.

    After moving to newer instances of Exchange and Windows server we will return to Puremessage.

    Fred