Understanding the static-virus-attack-backup verdict in Messaging Gateway

Products

• Messaging Gateway

Issue/Introduction

In Symantec Messaging Gateway (SMG), administrators may occasionally observe the static-virus-attack-backup verdict in the message audit logs. This article explains the technical behavior behind this verdict and why it occurs on established SMTP connections.

Cause

The static-virus-attack-backup verdict is a hidden policy that occurs during the following sequence of events:

1. Initial Malware Detection: SMG identifies one or more instances of malware within messages arriving over an active SMTP connection.
2. Penalty Box Trigger: As configured, SMG flags the source IP address and places it into the "Virus Attack" penalty box to prevent further malicious traffic.
3. Connection Persistence: Because an SMTP connection is already established and active when the penalty is triggered, the SMG cannot immediately terminate or defer that specific connection.
4. Verdict Assignment: For all subsequent messages arriving on this same already open connection, the SMG assigns the static-virus-attack-backup verdict. This acts as a secondary protective measure, identifying these messages as originating from an IP already flagged by the Virus Attack feature, despite the connection itself continuing to be processed.

This verdict is distinct from the static-virus-attack verdict, which is applied when a new connection is attempted from an IP that is already known to be in the penalty box.

Resolution

This behavior is Working as Designed.

The static-virus-attack-backup verdict indicates that the SMG is successfully identifying and tagging traffic from a known malicious source that was already connected before the penalty was applied. No configuration changes are required to "fix" this verdict, as it is fulfilling its purpose as a security safety net.

The action taken for messages which receive this verdict cannot be modified:

• Subject markup with the string "[WARNING: Virus Attack Detected] "
• Clean malware from any attachments