Email POP3 block

[ryld]

When the firewall detects any emails like below then it blocks that user's POP3 downloading. We have to log in to this user's email box via the web and delete the affected email. How to overcome this issue?

Blocking the infected email was okay. However, once the infected email has been blocked, the user is not able to receive legitimate emails via an email client (e.g. - Outlook client).

In order to receive emails from the client software, the user should use a web client to access email and delete the infected email.

Message meets Alert condition

Virus/Worm detected: MSIL/GenericKDS.61009645!tr; Protocol: POP3; Email Address From: Leo.Xu@hawk-garment.com; Email Address To: ; VIRUS REFERENCE URL: http://www.fortinet.com/ve?vn=MSIL%2FGenericKDS.61009645%21tr

date=2024-02-28 time=08:40:27 devname=ABC-FW devid=FGTXXXXX eventtime=1709089826925505450 tz="+0530" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" vd="root" policyid=12 poluuid="e100da34-a124-51ed-7447-cc89591e7491" policytype="policy" msg="File is infected." action="blocked" service="POP3" sessionid=8826144 srcip=192.168.100.183 dstip=X.X.X.X srcport=50050 dstport=110 srccountry="Reserved" dstcountry="United States" srcintf="internal" srcintfrole="lan" dstintf="wan2" dstintfrole="wan" srcuuid="d5af6b40-81b3-51ed-d772-ffda346792c5" dstuuid="ade9ac26-7473-51ed-8b94-09d66a6332bc" proto=6 direction="incoming" filename="Quote--FL202306200039 SWP Inquiry no. 2023-1981.zip" quarskip="Quarantine-disabled" virus="MSIL/GenericKDS.61009645!tr" viruscat="Virus" dtype="av-engine" ref="http://www.fortinet.com/ve?vn=MSIL%2FGenericKDS.61009645%21tr" virusid=10131263 profile="default" from="Leo.Xu@hawk-garment.com" analyticscksum="84cc0a87e59e1f25ecc09cc762d6283437d3375fc7b43d6044588ca8f8343eb4" analyticssubmit="false" crscore=50 craction=2 crlevel="critical" 

[AEK]

When the message is blocked, do you see any quarantined IP in your FG's quarantine monitor? (check in Dashboard > Users & Devices > Quarantine)

On the other hand can you try with IMAP instead of POP? I think it should have another behavior.