Email POP3 block
When the firewall detects any emails like below then it blocks that user's POP3 downloading. We have to log in to this user's email box via the web and delete the affected email. How to overcome this issue?
Blocking the infected email was okay. However, once the infected email has been blocked, the user is not able to receive legitimate emails via an email client (e.g. - Outlook client).
In order to receive emails from the client software, the user should use a web client to access email and delete the infected email.
Message meets Alert condition
Virus/Worm detected: MSIL/GenericKDS.61009645!tr; Protocol: POP3; Email Address From: Leo.Xu@hawk-garment.com; Email Address To: ; VIRUS REFERENCE URL: http://www.fortinet.com/ve?vn=MSIL%2FGenericKDS.61009645%21tr
date=2024-02-28 time=08:40:27 devname=ABC-FW devid=FGTXXXXX eventtime=1709089826925505450 tz="+0530" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" vd="root" policyid=12 poluuid="e100da34-a124-51ed-7447-cc89591e7491" policytype="policy" msg="File is infected." action="blocked" service="POP3" sessionid=8826144 srcip=192.168.100.183 dstip=X.X.X.X srcport=50050 dstport=110 srccountry="Reserved" dstcountry="United States" srcintf="internal" srcintfrole="lan" dstintf="wan2" dstintfrole="wan" srcuuid="d5af6b40-81b3-51ed-d772-ffda346792c5" dstuuid="ade9ac26-7473-51ed-8b94-09d66a6332bc" proto=6 direction="incoming" filename="Quote--FL202306200039 SWP Inquiry no. 2023-1981.zip" quarskip="Quarantine-disabled" virus="MSIL/GenericKDS.61009645!tr" viruscat="Virus" dtype="av-engine" ref="http://www.fortinet.com/ve?vn=MSIL%2FGenericKDS.61009645%21tr" virusid=10131263 profile="default" from="Leo.Xu@hawk-garment.com" analyticscksum="84cc0a87e59e1f25ecc09cc762d6283437d3375fc7b43d6044588ca8f8343eb4" analyticssubmit="false" crscore=50 craction=2 crlevel="critical"