"Clean" viruses?

We just had two malware deliveries which arrived at 5:14am this morning, at 6:40am I checked the queue and verified them at VirusTotal which showed a lot of detections so I reported them both to MDaemon and Virus False Negative and they were both rejected. This made me check my Security Antivirus update logs, the most recent AV updates, ClamAV had been updated at 4:01am and is still saying that it's up-to-date. Cyren Anti-Virus was updated at 4:11am and all checks since then say "The last updater run was less than an hour ago. Scheduled update is skipped"

So if we are sent any more copies of these viruses then they will clearly sail through - this makes my wonder what anti-virus service mail service MDaemon is using...

On Thu, 24 Feb 2022 08:03:44 -0500, "lists-md-anti-virus@mdaemon.com (Edmund Cramp)" <lists-md-anti-virus@mdaemon.com> wrote:
We just had two malware deliveries which arrived at 5:14am this morning, at 6:40am I checked the queue and verified them at VirusTotal which showed a lot of detections so I reported them both to MDaemon and Virus False Negative and they were both rejected. This made me check my Security Antivirus update logs, the most recent AV updates, ClamAV had been updated at 4:01am and is still saying that it's up-to-date. Cyren Anti-Virus was updated at 4:11am and all checks since then say "The last updater run was less than an hour ago. Scheduled update is skipped"

So if we are sent any more copies of these viruses then they will clearly sail through - this makes my wonder what anti-virus service mail service MDaemon is using...

---

View/reply at "Clean" viruses?

--MD-AV-PLUGIN-------------------------------------------------------
This list is for questions and discussion about AntiVirus plugins for
MDAEMON. To unsubscribe from this mailing list send an email to 
md-av-plugin-unsubscribe@mdaemon.com .
--POWERED BY MDAEMON!------------------------------------------------

---------------------------------------------------------------------
These forums are provided by MDaemon Technologies for user-to-user 
support and discussion.  MDaemon staff members may participate in the 
forums periodically but please recognize that this is not the official
method of receiving technical support. To receive personal technical 
support please use the form here:
http://www.mdaemon.com/Support/RequestSupport/
---------------------------------------------------------------------

--MD-AV-PLUGIN-------------------------------------------------------
This list is for questions and discussion about AntiVirus plugins for
MDAEMON. To unsubscribe from this mailing list send an email to
md-av-plugin-unsubscribe@mdaemon.com .
--POWERED BY MDAEMON!------------------------------------------------

---------------------------------------------------------------------
These forums are provided by MDaemon Technologies for user-to-user
support and discussion.  MDaemon staff members may participate in the
forums periodically but please recognize that this is not the official
method of receiving technical support. To receive personal technical
support please use the form here:
http://www.mdaemon.com/Support/RequestSupport/
---------------------------------------------------------------------

Yes, those sessions would have been mine - I'm not complaining about this, just letting you know what's happening. This is just a thought ... would it be better to accept and delete all detected viruses? Effectively, thinking like a hacker, I see "Viruses refused" as providing feedback to the malware authors that they need to update their malware whereas if we were just accepting the viruses and deleting them, then the malware might not get updated so often?
I'll try reconfiguring MD to do this.

This is just an idea, MD can scan all the mailboxes everyday and occasionally finds infections in users spam folders, but I'm quarantining virtually all messages with attachments that I see as potential infections ... e.g. *.gz, *.zip, *.bat, *.exe etc., and then I check suspicious messages by uploading them to VirusTotal after reviewing the headers.
It might be a useful option for the future to add the option to do an AV scan of quarantine folder contents every hour.