Cloudmark is now part of Proofpoint. Learn More

About Proofpoint

Checking attachments for viruses and removing only the affected one(s)

Issue:

Cloudmark is selecting all attachments for removal when only one attachment is virally infected.

Solution:

 

  1. In Cloudmark Authority, run the ATTACHMENT phase from the CONTENT phase.
  2. NOTE: Ensure that you explicitly enable any new ATTACHMENT phase that you create. By default, ATTACHMENT phases are not enabled.

  3. Call Cloudmark Anti-Spam to check each attachment in the attachment phase.
  4. application apply [Cloudmark Anti-Spam] 
  5.  Check the Cloudmark verdict for "Virus" category, remove attachment on match otherwise process next attachment. 
IF [Condition] variable [_cmae_descr] (string) [contains] [Virus]
THEN [Function] log with level [NORMAL] in log file [custom] message [msgid=$(_id) Virus Found - remove attachment 
                              name=$(_imp_attachment_name)]
[Stop] REMOVE ATTACHMENT
ELSE [Function] log with level [NORMAL] in log file [custom] message [msgid=$(_id) Virus Not Found - keep attachment
                             name=$(_imp_attachment_name)]
[Stop] NEXT ATTACHMENT

 

Request support

Support Categories

Search Knowledge Base

 
 
Site Map  •  Privacy Policy  •  ©2002–2019 Cloudmark, Inc.