6
This message has been quarantined because a virus was found (Win.Exploit.CVE_2019_0903-6966169-0)
Problem reported by Alex Hee - 5/27/2019 at 12:34 AM
Resolved
Not sure what is wrong with the SmarterMail. Started since 26th May it detected above virus on some emails with PDF file even though the email is not affected by viruses.

The temporary solution is to disable ClamAV. Any idea what is happening?

22 Replies

Reply to Thread
0
Simone Schilirò Replied
Same problem here
0
Patrick Kraus Replied
We have had to disable Clam as well. It appears that this is a false positive and has been reported widely across multiple forums.

We are enabling clam every 2 hours and running the update to see if any updated have been released by them but have had no luck as of yet.

The other option would be to white-list the signature but I dont thing this is an option for this setup of Calm.
0
Manuel Martins Replied
Same problem here!
0
Ng Cher Choon Replied
Same problem here. Some domains can send out the attachment successfully but many domains have the above problem sending the same attachment. This affects mainly the PDF attachment.
0
Gonzalo Varela Rua Replied
Also here
0
CTL Replied
Support Team should review the issue, We have similar issue faced  some of our clients.

Any relation between Zero day vulnerability  from Microsoft patch ?


Thanks

1
William Fock Replied
Seems like someone has mentioned it's fixed 4hrs ago. (ard 1035pm SGT time) +0800

0
Kyle Kerst Replied
Employee Post
This issue does appear to be a false positive problem introduced by a ClamAV signature update as best we can tell. I have tested with the updated signatures (this morning) and I am no longer seeing the same failures, which is in line with William's comment above. To test this in your own environment, head over to Settings>Antivirus and use the menu to update the ClamAV Virus Definitions. At that point you should be good to enable the ClamAV scanning again. Please monitor for any further issues as well. 
Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
1
Manuel Martins Replied
Yeasterday afternoon ClamAV updated it's database and after that the problem was solved.

0
LeapSwitch Networks Replied
How do we retry the quarantined emails ?
2
Manuel Martins Replied
On the "Virus Quarantine" option just select the emails and then go to the button with the three dots and choose "Resend"
0
LeapSwitch Networks Replied
I am aware of the resend option, but how do I find out which emails were quarantined for this issue ?
0
Alex Hee Replied
Confirmed the issue has been resolved with yesterday updated virus pattern. For those who want to restore the quarantine email just go to Spool - Virus Quarantine & filtered quarantine emails based on date (25-29 May) . Then select emails that you wanted & resend. Done.
0
Simone Schilirò Replied
Solved!
1
Nathan Replied
To resolve quickly in future create a .ign2 file, for example exceptions.ign2 in the clamdb folder and put 'Win.Exploit.CVE_2019_0903-6966169-0' or whichever definition is generating the false positive on a line. Reload clam and it should then ignore the definition.
0
Kyle Kerst Replied
Employee Post
Thanks Nathan! I'm going to make a note of this here in support as well, perhaps we can get that added as a KB article. 
Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
0
CTL Replied
Again the false positive issue re appear on build 7093 ,  Support team  pleas have a look and let me know the solution.

Thanks
0
Martin Margheim Replied
Surprise, surprise! My server is a very low volume server with only a few email domains. Today, after reading this thread, I investigated and was surprised to find what I believe was the email my clients have been reporting not receiving and the answer to email with attachments identifying as viruses.

All quarantined email has been released. Glad someone had the answer.

Thanks
Martin
0
Martin Margheim Replied
If you read my previous, I received another surprise. Turning off Clam AV did not resolve my problem. Turning off Windows Defender solved the attachment send on my Smartermail server. 

Clam AV is turned on and attachments come through without quarantine whereas with Windows Defender on, email is quarantined.

Martin
0
Sabatino Replied
I suggest you disable windows defender

Unfortunately, sometimes there are false positives. I discussed this problem with SM via ticket and also here and they confirmed it to me. Unfortunately, windows defender sometimes generates false positives. The proposed solution was to repeat the scan again in the event of a positive result from Windows Defender. But to date it doesn't seem to me that we have implemented it. So I would say that using defender makes the system unreliable, and therefore until SM finds a solution it shouldn't be used.

I took the trouble to check all the messages that windows defender reports as viruses and to check them manually and I assure you that false positives are not such a rare event, especially with attachments larger than 1Mb


Here is an excerpt from my ticket

Hey Sabatino,I talked to the developers and they said that the way that defender works is when it scans it can sometimes say hey this might be a virus and marks it as a virus then later on once Microsoft does more scans on it and does its internal stuff then it goes this isn't a virus.  So this issue is with just the way that defender works. I'm going to make this ticket into a feature request to add the ability for defender to rescan emails then if it comes back as not a virus it will send it through. Kind Regards

Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
0
Martin Margheim Replied
I have no problem with Windows Defender being disabled. For my MSP clients, Bit Defender is used locally. I am reporting that 24 hours after discoveries, disabling Windows Defender in Smartermail and leaving Clam AV with June 7 definition updates, there have been no further virus reports for email with attachments. Clients are reporting email is now being received with attachments and the quarantine remains empty.

FYI

Martin
0
Manuel Martins Replied
This is very strange! We have 2 SM Servers, both servers using SM 8552. The Primary Server and an Inbound Gateway, the situation of Windows Defender identifiing attachments as Virus false positives only happens on the SM Primary Server, on the Inbound Gateway Server Windows Defender is also active and the situation is not happening, only detects some attachments but after a closer look they are really virus.
The Windows Defender version is the same on both servers also.

Manuel Martins

Reply to Thread