False / Positive ransomware Forticlient EMS 7.4.5
Last week, I upgraded the Forticlient EMS server to version 7.4.5. The workstations are still running 7.4.4.
A few days later, I noticed that there were 3500 files in Quarantine.
This wasn't the case before. Users can no longer find some of their files.
For example, Spyder is a scripting app we use for data analysis, modeling, and reading/editing files.
I've never had a problem with it.
But now users are getting the following error:
I also see, for example, .xlsx files from some users' OneDrive files incorrectly in Quarantine.
These exclaimer files are also valid:
When I click on the ransomware link, I get the FortiGuard Labs message below:
Unavailable
Could not retrieve this virus at this time. Please try again later.
Any idea why there are suddenly so many false/positives?
