OK here is somethink I do not understand. You wrote you have better grey detection in GAM2014.2
So I expect findings should be the same....
Will you please verify this link?
Using our productive proxy I receive: McAfeeGW: JS/Exploit-Blacole.lj
the new GAM does not find anything....
The file contains a link to http://220.127.116.11/!rodzinka/LZ6427Dm.php?id=13419783 and this is definetly a link you should not visit... 🙂
In the attachment you will find the file I received after visiting the link.
Afaict, the jsp is sane so far apart from the redirect to the malware.
the below is likely why you get no conviction now. Can you access the payload from your company?
The following Link:
is detected as PUP by the current engine.
The new GAM detects nothing...
and virustotal.... (without any comment)
|ESET-NOD32||a variant of Win32/ClientConnect.A potentially unwanted||20150209|
|K7AntiVirus||Trojan ( 0049ef011 )||20150209|
|K7GW||Trojan ( 0049ef011 )||20150209|
The transferred file contained a virus and was therefore blocked. URL:
So we catch that with Artemis.
But why did not virtustotal detect the malware using the MWG Engine?
Now I can see the site is rated as malicious.... (I was unrated this morning). Also the GAM detect now the object....
Is there a process where MC checked virustotal findings? 🙂
This is with all objects I've tested here. I've tested a few untested findings a few minutes ago (also findings from yesterday), there I've the same result. GAM did not find anything. Virtustotal has findings with 5-8 different virusengines.
Ok here is the next one....
Site is uncategorized by McAfee
Using Virus Total
ist PUP using Current Enging
Nothing using New GAM
Media Type: application/executable /
WebSite Reputation: Unverified (16)
Avira Version: Avira-Engine=18.104.22.168|Avira-VDF=22.214.171.124|Avira-Savapi=126.96.36.199
McAfee Version: AM-DAT=3516|AM-Engine=7001.1402.1890|MFE-DAT=7708|MFE-Engine=5700|Avira-Engine=188.8.131.52|Avira-VDF=184.108.40.206|Avira-Savapi=220.127.116.11
Chrome Browser said "Potential Malicious"
and Virus Total
|AVware||InstallIQ Installer (fs)||20150211|
|ESET-NOD32||a variant of Win32/InstallIQ.A potentially unwanted||20150211|
|K7AntiVirus||Unwanted-Program ( 0040f9a91 )||20150210|
|K7GW||Unwanted-Program ( 0040f9a91 )||20150211|
|VBA32||suspected of Trojan.Downloader.gen.h||20150210|
|VIPRE||InstallIQ Installer (fs)||20150211|
As you can see Mc detects also the file. But our Proxy says: CLEAN!!!
I'll give you a call Frank, to check some options.
According to your screenshot - there is detection by GAM on VT.
I'm on the latest and greatest 7.5.1 btw.
all the detection issues here are Artemis (Cloud Lookup) related. With the GAM v2014 the way the Artemis lookups are done has been changed and if you need to import a rule to activate those lookups in MWG. The ruleset is in the Rule Library, you can find it under the Common Rules. The name is "Set URL Filter Internal Settings".
Fresh MWG 7.4 (and higher) installation have this ruleset by default. If you upgraded from older MWG versions this ruleset might not exist and needs to be imported. This should be done, even if you still use the v2013 GAM engine version, as it will enable the engine to use Trusted Source reputation and categorization information for the detection. The v2014 GAM engine requires this rule also for the file reputation, the v2013 did the file reputation in a different way.