Skip to main content
Perrine
Perrine
New Member
June 6, 2014
Question

High security alert => infected with virus " unknown" ==> [SOLVED]

  • June 6, 2014
  • 3 replies
  • 24508 views
Hi all ! I' m having a problem on a FG110C cluster running v4.0 MR3 patch15. Let me explain... I' m using antivirus feature to scan web traffic and since a few weeks, internet users get this message : High security alert !! You are not permitted to download the file " " because it is infected with the virus " unknown" URL = [the whole URL] File quarantined as : . http://www.fortinet.com/ve?vn=unknown Does anybody know what' s wrong ? Note that this error appears and then a few seconds later when you try to access exactly the same thing, you don' t have any problem... Regards, Perrine

    3 replies

    netmin
    netmin
    New Member
    June 6, 2014
    Hi Perrine, there' s an older KB article referring to heuristic AV detection " virus=unknown" : http://kb.fortinet.com/kb/documentLink.do?externalID=11227 producing (log) messages like this. Maybe you can check if " config antivirus heuristic" is set to block files. Flow-based inspection may produce some false positives as well. Btw: even more interesting is that google provides a number of results (websites not related, also no SEO) when searching for the exact phrase - it almost seems that FGTs may also present this message to the rest of the world under certain conditions.
    Perrine
    PerrineAuthor
    New Member
    June 12, 2014
    Hello netmin, Thanks for your answer. The KB you mentioned seemed to concern very old FortiOS version. In 4.0 MR3 patch 15, in the antivirus profile the options you can configure are very limited. In fact there are only 2 : proxy or flow based I found that due to migration my configuration was a third option named " custom" I had no idea on what " custom" was and changed it to flow based. It seems to solve my problem. I' ll keep this post opened for a few days to be sure and then I' ll close it. Regards, Perrine
    Perrine
    PerrineAuthor
    New Member
    June 16, 2014
    Hi all, Changing profile settings from custom to flow-based or proxy solved my problem. Regards; Perrine
    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!