Blocked because of virus

[sarif]

when i open my webmail in external i got this error : Blocked because of virus A virus was detected, originating from your system. Please contact the system administrator. Help Me...

[Dipen]

Is your Webmail servers published on Internet via fortigate ? Are UTM filters enabled on the policy? A screenshot of error should be helpful.

[Sean_Toomey_FTNT]

Hi Sarif, This message means the FortiGate AntiVirus detected a virus coming from your machine. This means at minimum some UTM is enabled, but more importantly your machine is likely infected. There' s a small chance it' s a false positive, but usually that is a big warning sign. Once you have determined your machine is free of virus (use a couple of scanning tools to be sure), try again. If you continue to face this issue, please open a TAC case. Include the following: 1. Backup of system config 2. Diag debug report / exe tac report 3. Packet capture from your machine and/or on the FortiGate when the issue is occuring. I am confident they will get you fixed, and probably with a lot less back and forth questions than I would have since they could see your entire config. Cheers!

[Nihas]

You can check the FG User&Device - Monitor - Banned User to understand why the machine is blocked. If the machine is able to surf the things after 5 minutes, that is for sure something has happened from or to the machine.