"Malware 'Unscannable' was detected and blocked in a download" Every Minutes

Question

Hi, i've got this message every minute since yesterday.

Have you got a any idea ?

-pete- · Answer

Hi Xitey, 
 Based on the log snippets you have attached, the latest AV signatures are installed on your device and are being used by the AV scanning service. Can you please verify that HTTP requests are still being blocked as unscannable? It's possible that your firewall had queued up those email alerts and you were still receiving the notifications after the issue had been resolved. The date/time of the event is included in the body of the email alert so you can use that to determine if the alerts are outdated. 
 If you are still having issues with traffic being blocked as unscannable, please attach the output of this command: grep -w ERROR /log/avd.log | grep sophos__scanfile | tail -n 100 
 Thanks, Peter Gale | Director, Software Development, NSG

-pete- · Answer

Hi Xitey, 
 I suspect that the alerts were generated on October 8th and are queued for delivery in your mail spool. They will continue to be delivered until the queue is empty. Can you verify this by browsing to Email > Mail spool, then filter using the following parameters: Start Date = 2022-10-07, End Date = 2022-10-09, Recipient domain = All, Sender/recipient/subject = HTTP virus detected. Tick only the "Queued" tickbox, then click Filter. 
 If that search returns some number of entries, you can tick the "Select All" checkbox and click Delete to remove them from the outbound queue. 
 Hope that helps, Peter Gale | Director, Software Development, NSG

"Malware 'Unscannable' was detected and blocked in a download" Every Minutes

Top Replies