Virus blocked only after outbound forwarding attempt

[jlar310]

We have a couple of addresses that get forwarded (by our back-end mail system) to addresses outside of our domain. We occasionally get notifications from proxmox that it blocked an outbound virus going to that forwarded external address. So it appears that the message gets past the inbound virus check, is handed off to the back-end server which forwards it to an outside domain and *then* proxmox detects the virus. Why would it not get caught on the inbound virus check which is our highest priority rule?

We have all the latest hotfixes. The message in question is the bogus UPS delivery notification with a zip attachment, which has also been missed by the inbound virus scan and delivered to local addresses. It's only caught on the outbound virus scan.

 

[tom]

We have a couple of addresses that get forwarded (by our back-end mail system) to addresses outside of our domain. We occasionally get notifications from proxmox that it blocked an outbound virus going to that forwarded external address. So it appears that the message gets past the inbound virus check, is handed off to the back-end server which forwards it to an outside domain and *then* proxmox detects the virus. Why would it not get caught on the inbound virus check which is our highest priority rule?

We have all the latest hotfixes. The message in question is the bogus UPS delivery notification with a zip attachment, which has also been missed by the inbound virus scan and delivered to local addresses. It's only caught on the outbound virus scan.

Seems the virus is not detected because of some unsupported encoding or mime encoding. To analyze, we need the original mail in RAW format (eml).

NOTE: If you forward a mail, the mime message is changed - so that could explain the behavior.

Please can you sent the email with the virus in a password protected zip file to support@proxmox.com?

 

[jlar310]

The message was never stored at any point, so I can not provide a copy at this time. It's not happening all that often, so I'm not sure when I'll see another example.

 

[tom]

just enable the virus quarantine (replace "block" with "quarantine" in your rules)