SmarterMail/Cyren Antivirus quarantined a message improperly
Problem reported by Matthew Bramble - 12/3/2018 at 1:25 AM
While trying to evaluate Cyren Antivirus, I came across a legitimate message in my quarantine from Groupon.  I tracked this down in the delivery log and found that it was quarantined because a virus was found.  I then went into the Cyren Antivirus log and I found that this particular message was skipped in the logs.  It appears that there was some form of communication error between Cyren and SmarterMail, and SmarterMail treated this as being a virus.  Maybe in order to avoid situations like this, SmarterMail could be coded to apply specific result codes or at least throw out larger integers that could result from an error (or whatever is happening in this process between the two programs).  I'm fairly certain that Cyren didn't actually detect a virus in this message as the same user received many other messages from Groupon this same day.  Random errors like this being captured as a virus are certainly not an acceptable. Logs of this are below, with the Cyren log showing a skipped message 25013:

[2018.11.29] 12:34:54 [25013] Delivery started for c1e77ae2-2e49-11e4-a5bc-00259096a2fa@bounce.r.groupon.com at 12:34:54 PM
[2018.11.29] 12:35:00 [25013] Added to SpamCheckQueue (1 queued; 1/50 processing)
[2018.11.29] 12:35:00 [25013] This message has been quarantined because a virus was found.
[2018.11.29] 12:35:00 [25013] Removed from SpamCheckQueue (2 queued or processing)
[2018.11.29] 12:35:03 [25013] .eml file not found.  Removing .hdr file.
[2018.11.29] 12:35:03 [25013] Delivery finished for c1e77ae2-2e49-11e4-a5bc-00259096a2fa@bounce.r.groupon.com at 12:35:03 PM    [id:17325013]

12:34:57 Reading Message from Stream...
12:34:57 Scanning Message: 25012
12:34:57 Sent Result(25012:Unknown|Unknown) back to server
12:35:00 Reading Message from Stream...
12:35:00 Scanning Message: 25014
12:35:00 Reading Message from Stream...
12:35:00 Scanning Message: 25015
12:35:00 Sent Result(25014:Unknown|Unknown) back to server

Reply to Thread