Well Kyle
I was starting to question my sanity.
In the last few months I have opened various tickets but they have all fallen on deaf ears. Yet I was convinced that there was something that was not going well.
Maybe I was the only fool who thoroughly studied what windows defender was doing, checking all the logs and manually checking the quarantined .eml files one by one for false positives
Allow me to add some notes:
The exclusion of the folder only
Add-MpPreference -ExclusionPath "C: \ SmarterMail \ Domains"
and since the .eml extension is not excluded
the folder c:\SmarterMail\Spool in my opinion could have problems
Same thing the c:\smartermail\archive folder and related custom archive folders
also in the c:\smartermail\temp folder I see .eml appearing
This morning I found myself in the logs both this
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Script/Conteban.A!ml&threatid=2147735508&enterprise=0 Name: Trojan: Script / Conteban.A! Ml
ID: 2147735508
Severity: Severe
Category: Trojan
Path: file: _C:\Windows\Temp\cteng6141A17659CE.tmp
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
User: NT AUTHORITY \ SYSTEM
Process Name: C:\Program Files (x86)\SmarterTools\SmarterMail\Service\Cyren\bin\ctasd.exe
Security intelligence Version: AV: 1.349.741.0, AS: 1.349.741.0, NIS: 1.349.741.0
Engine Version: AM: 1.1.18500.10, NIS: 1.1.18500.10
be this
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:MSIL/AgentTesla.JPI!MTB&threatid=2147793742&enterprise=0 Name: Trojan: MSIL / AgentTesla.JPI! MTB
ID: 2147793742
Severity: Severe
Category: Trojan
Path: amsi: _C:\Program Files (x86)\SmarterTools\SmarterMail\Service\MailService.exe
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: AMSI
User: NT AUTHORITY \ SYSTEM
Process Name: C:\Program Files (x86)\SmarterTools\SmarterMail\Service\MailService.exe
Security intelligence Version: AV: 1.349.741.0, AS: 1.349.741.0, NIS: 1.349.741.0
Engine Version: AM: 1.1.18500.10, NIS: 1.1.18500.10
but in your opinion it is not better to exclude the processes
Process Name: C:\Program Files (x86)\SmarterTools\SmarterMail\Service\MailService.exe
C:\Program Files (x86)\SmarterTools\SmarterMail\Service\Cyren\bin\ctasd.exe
in the log as process name puts the complete path ... I don't know if it is needed
ctasd.exe creates a .tmp file in windows / temp
it is the .tmp that is intercepted