Description
This article describes how to proceed in cases where a virus has apparently passed through a FortiMail unit undetected, while an Eicar test file (Download Eicar) is detected correctly.
This problem could happen in the case where the signature for the virus that passed was not yet included in the Fortinet AV database, or where the most recent AV definition files have not been updated on the FortiMail.
This problem could happen in the case where the signature for the virus that passed was not yet included in the Fortinet AV database, or where the most recent AV definition files have not been updated on the FortiMail.
Scope
FortiMail.
Solution
- Get the infected file.
- Use the FortiGuard Center web portal to verify whether the virus is present in the latest antivirus database.
- If the file is reported as clean, it means that FortiGuard does not yet have a signature for it. It is possible to submit the file directly to the Fortinet antivirus team on the same web page. Note that the file will not be detected until the database is updated by the Fortinet antivirus team.
- If the file is reported as infected, the next step is to check the version of the antivirus database that is installed on the FortiMail.
- Take the 'Virus' option from the FortiGuard Center web portal (Antivirus Service) and make a note of the latest antivirus database version. For example, 92.06558.
- Verify that the latest database is installed on FortiMail.
- If the unit does not have the latest definition, it can be downloaded by using the 'Update Now' button. It may take a few minutes to update the database, depending on the network speed.
CLI Configuration:
The same check can be performed through the CLI:
FML#diagnose autoupdate versions
System Time: 2024-08-14 16:56:22 CEST (Uptime: 0d 1h 23m)
AV Engine
---------
Version: 6.00297
Contract Expiry Date: Mon Feb 17 01:00:00 2025
Last Updated using manual update on Wed Jan 31 20:24:00 2024
Last Update Attempt: Wed Aug 14 16:05:27 2024
Result: No Updates
Virus Definitions:
---------
Version: 92.06558 <-----
Contract Expiry Date: Mon Feb 17 01:00:00 2025
Last Updated using scheduled update on Wed Aug 14 16:05:27 2024
Last Update Attempt: Wed Aug 14 16:05:27 2024
Result: Updates Installed
---------
To update the databases, run:
-update only AV databases
FortiMail #execute update av
Or:
-update all databases
FortiMail #execute update now
Once the databases are up-to-date (and the FortiGuard Centre web portal page confirms that the file can be detected), the infected file should no longer pass. This can be verified by re-sending the infected file through FortiMail.
If the problem persists, create a support ticket and attach the following files:
If the problem persists, create a support ticket and attach the following files:
- Configuration backup.
- The output of 'diag autoupdate versions'.
- The infected file.
- A cross-search result for the mail that should be blocked by an Antivirus check. The steps to do this are explained in the FortiMail Admin Guide in the section 'Cross-searching log messages'.
