Anti-Virus engine Sophos. Interim verdict: ENCRYPTED means? ESA C670.

[bsrinu001]

Hi Team,

I would like to know "Anti-Virus engine Sophos. Interim verdict: ENCRYPTED"

scanned by Anti-Virus engine. Found encrypted ---log says/ DCID has been genarated and delived to intended recipient as well

Note : The sending Ips/domain has been whitelisted on our ESA's.

Means the attechment has been deliverd right? is there any malfunction at ESA? please clarify. 

[dmccabej]

Hello,

This log would mean that the Sophos engine scanned and found the message to be encrypted. For the behavior of what happens next, this can be configured under Mail Policies --> Incoming/Outgoing Mail Policies --> Anti-Virus --> Encrypted Messages.

Sophos AV defines an encrypted message as the following (found in Online Help) :

Encrypted Message Handling

Messages are considered encrypted if the engine is unable to finish the scan due to an encrypted or protected field in the message. Messages that are marked encrypted may also be repaired.

Note the differences between the encryption detection message filter rule (see Encryption Detection Rule) and the virus scanning actions for “encrypted” messages. The encrypted message filter rule evaluates to “true” for any messages that are PGP or S/MIME encrypted. The encrypted rule can only detect PGP and S/MIME encrypted data. It does not detect password protected ZIP files, or Microsoft Word and Excel documents that include encrypted content. The virus scanning engine considers any message or attachment that is password protected to be “encrypted.”

Thanks!

-Dennis M.