To better support you as a SWG customer, Skyhigh Security has improved the processing of your virus and antimalware submissions.
Obtaining a sample
To accurately diagnose a suspected false detection, you must collect samples from within your environment. Use the instructions in the
Virus To File.pdf, attached to this article, to obtain, compress, and encrypt the sample directly from the SWG appliance.
Submitting the sample
Use the SWG virus detection block page to determine where to submit the sample:
- VirusName: McAfeeGW. If empty, follow the Gateway Anti-Malware (GAM) submission steps below.
- VirusName: McAfee. Follow the AV submission steps below.
- VirusName: Avira. Follow the Avira submission steps below.
For GAM versions v2015 and later, engine information is no longer provided by the API. This version is implemented in SWG 7.6.x and later.
IMPORTANT: For all submission processes, you must send the sample as a compressed and encrypted .zip file, using the word
infected (lowercase, without quotes) as the encryption password.
Gateway Anti-Malware (GAM)
Submit the sample in a Service Request:
After you've collected and encrypted the sample using the
Virus To File.pdf file, open a
Service Request with Technical Support to submit the sample.
NOTE: Make sure that you select
Product as the source of your problem, and select
Web Gateway in the Product field. (Don't select Malware as the source of your problem.)
Along with the sample, provide the following:
- SWG version
- GAM Engine version: You can find the version in the SWG user interface (UI) at Dashboard, Gateway Engine.
- Gateway DAT version: You can find the version in the SWG UI at Dashboard, Gateway DATs.
- Found_viruses.log: You can find this when you log on to the SWG UI at Troubleshooting, Log Files, User-defined-logs, Found_viruses.log. Make sure that Body.FullFilename is being logged, and provide the found_viruses.log that encompasses the time frame of the problem.
- Sample URL that led to the detection.
- The detection name of the potential false-positive from your block page.
- If the Avira sample is larger than 50 MB, open a Service Request with SWG Technical Support to submit the sample. You can submit a Service Request from the ServicePortal.
- If you don't receive a timely response after you submit the samples, or if you disagree with the analysis provided by Avira, open a Service Request with SWG Technical Support. Include the Avira tracking number.
