Video Screencast Help

Remove unscannable attachment from Virus Outbreak count in Virus Outbreak email notification.

Created: 14 Jun 2010 • Updated: 04 Jan 2013 | 4 comments
Serpentz's picture
8 Agree
0 Disagree
+8 8 Votes
Login to vote
Status: In Development

I have set a threshold to be aware when we receive more than x viruses in a day... but the email notification get trigered often because Brightmail count as a virus the unscannable attachment.

I'm getting the same thing. I had to disable the alert for the time being. I don't believe unscannable attachments should count towards virus outbreaks, or you should be given the option to choose.

Comments 4 CommentsJump to latest comment

Cricket17's picture

Nearly all unscanable are malformed mime attachments, which by it-self is not a virus, and my experience with captures is that most are actually simple spam.

From converstations with Symantec, they seem to think treating it like a virus reflects the worst-case situation.   I think it's more like someone not completing the correct SMTP  handshake process and should be treated seperate from viruses.

Login to vote
LEOL's picture

Totally agree! And I would like to add password protected zip (VIRUS NAME: PSW_ZIP_ERR) to the Unscanable attachment in additional to malformed mime.

Login to vote
kyhick's picture

I agree with Serpentz. unscannable attchments should not be counted as virus. I also had to disable the alerts. After a while there are so many alerts they just get ignored and deleted so what was the use of being alerted.

Login to vote
Amanda Grady's picture

Unscannable verdicts will be broken out from the malware verdicts in Symantec Messaging Gateway 10.5. In additional it will be possible to take granular actions for different types of unscannable verdicts.

Login to vote