Mail with malicious attachment not detected by Messaing Gateway

Products

• Messaging Gateway

Issue/Introduction

An email message with an attachment was accepted and delivered by Messaging Gateway (SMG) but another malware detection system such as Endpoint Protection flagged the attachment as malware.

Cause

While SMG uses the latest malware detection engine with automatically updated definitions and heuristics, other malware detection products may have access to different forms of malware detection not available to Messaging Gateway due the details of their operation or their position in the network or on the endpoint.

Resolution

Any malware which was not detected by Messaging Gateway should be submitted to the Broadcom Security Response team via https://symsubmit.symantec.com/.

To ensure that Messaging Gateway is operating as expected, please perform the following health checks for the SMG system:

• Confirm that malware definitions are being regularly updated via the Control Center Status > Dashboard page
• Check the logs for any errors via the Status > Logs page
• Confirm that malware scanning was performed on the message and what verdict was returned via the Status > Message Audit Logs page.