Logout

Alt-N Discussion Groups > MDaemon Discussion Groups > MDaemon Anti-virus Plug-in > (Cyren AV) false positive

 [F] Alt-N Discussion Groups  / MDaemon Discussion Groups  / MDaemon Anti-virus Plug-in  /

(Cyren AV) false positive

[Ilie, Voinea]
Voinea Ilie
Newbie
Newbie
Posts: 16
Voinea Ilie - 04:59am, Nov 12 2020

Hello,
Today I had email sessions, I say, antivirus false positive.
When the IMAP user logged in and sent the email, the message was:
...
Thu 2020-11-12 11:10:24.070: Passing message through AntiVirus (Size: 1271)...
Thu 2020-11-12 11:10:24.105: * Message is clean (no viruses found) scanned by (Cyren AV) (ClamAV)
Thu 2020-11-12 11:10:24.105: ---- End AntiVirus results
....

Next step, the following message appears in all.log:
....
Thu 2020-11-12 11:10:25.397: Start MDaemon AntiVirus results (Cyren AV) (ClamAV)
Thu 2020-11-12 11:10:25.505: * (Cyren AV) pd805631904.hdr is infected by Trojan.HVMA-37
Thu 2020-11-12 11:10:25.505: * pd805631904.hdr was removed from message
Thu 2020-11-12 11:10:25.507: * pd805631904.hdr quarantined to C:\MDAEMON\CFILTER\QUARANT\
Thu 2020-11-12 11:10:25.531: * Total attachments scanned : 3 (including multipart/alternatives and message body)
Thu 2020-11-12 11:10:25.531: * Total attachments infected : 1
Thu 2020-11-12 11:10:25.531: * Total attachments disinfected: 0
Thu 2020-11-12 11:10:25.531: * Total errors while scanning : 0
Thu 2020-11-12 11:10:25.531: * Total attachments removed : 1
...
and the email has been blocked.

After I deactivated Cyren AV the emails were sent!!
Mdaemon version v20.0.3
These errors started to appear today at 7:00AM EET.

Thanks,
Ilie

  (older msg: 1)All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items

Scott Fisher - Nov 12, 2020 12:18 pm (#2 Total: 5)  

 

Photo of Author
Scott Fisher
Newbie
Newbie
Posts: 1
I am having this problem today as well.

Tristan Cuschieri - Nov 12, 2020 2:56 pm (#3 Total: 5)  

 

Photo of Author
Tristan Cuschie…
Newbie
Newbie
Posts: 1
Confirming that we are seeing the same behaviour. Our remedy was to switch to ClamAV until Cyren can publish a patch.

Arron Caruth - Nov 13, 2020 8:25 am (#4 Total: 5)  

Guest User  

Photo of Author
Posts: 1

Cyren confirmed it was a false positive and have released a signature update to fix the issue. I have tested it with the latest updates and the issue appears to be corrected.  Please update to the latest AV definitions and let us know if you are still having issues.

 

 

--
Arron Caruth
Vice President of Product Development
o: 817-601-3222    e: Arron.Caruth@mdaemon.com

MDaemon Technologies
Simple Secure Email
Visit us on www.mdaemon.com | Facebook | LinkedIn | YouTube
Sent using the MDaemon Email Server

From: md-av-plugin@mdaemon.com [mailto:md-av-plugin@mdaemon.com] On Behalf Of lists-md-anti-virus@mdaemon.com (Tristan Cuschieri)
Sent: Thursday, November 12, 2020 1:56 PM
To: md-av-plugin@mdaemon.com
Subject: [md-av-plugin] (Cyren AV) false positive

 

Confirming that we are seeing the same behaviour. Our remedy was to switch to ClamAV until Cyren can publish a patch.


View/reply at (Cyren AV) false positive

 
 
--MD-AV-PLUGIN-------------------------------------------------------
This list is for questions and discussion about AntiVirus plugins for
MDAEMON. To unsubscribe from this mailing list send an email to 
md-av-plugin-unsubscribe@mdaemon.com .
--POWERED BY MDAEMON!------------------------------------------------
 
---------------------------------------------------------------------
These forums are provided by MDaemon Technologies for user-to-user 
support and discussion.  MDaemon staff members may participate in the 
forums periodically but please recognize that this is not the official
method of receiving technical support. To receive personal technical 
support please use the form here:
http://www.mdaemon.com/Support/RequestSupport/
---------------------------------------------------------------------

--MD-AV-PLUGIN-------------------------------------------------------
This list is for questions and discussion about AntiVirus plugins for
MDAEMON. To unsubscribe from this mailing list send an email to
md-av-plugin-unsubscribe@mdaemon.com .
--POWERED BY MDAEMON!------------------------------------------------

---------------------------------------------------------------------
These forums are provided by MDaemon Technologies for user-to-user
support and discussion.  MDaemon staff members may participate in the
forums periodically but please recognize that this is not the official
method of receiving technical support. To receive personal technical
support please use the form here:
http://www.mdaemon.com/Support/RequestSupport/
---------------------------------------------------------------------

Voinea Ilie - Nov 16, 2020 3:24 am (#5 Total: 5)  

 

Photo of Author
Voinea Ilie
Newbie
Newbie
Posts: 16
It works now, without false positive, I had to activate Cyren first in order to update it!
Thank you for your support!



  All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items



 Content:

Read New | Search

 Guest:

Email to Admin



You are visiting as a Guest user.