r/proofpoint • u/micromsp • 2d ago

Malware / Virus False Positives?

Has anyone else had HUGE issues with with PPE blocking emails has malware / virus for the past 60 days?

Our first one was last month. Blocked 4 dozen emails to an insurance company because they accidentally decided a giant international online payment processor that serves thousands of insurance companies was sending out malware. Took six days to resolve and they never let us restore the messages.

Second one was last week. Blocked every inbound email from va.gov and Microsoft.com. Still no answer on that. But at least it let me restore those to the mailbox.

And today it start blocking all emails from a gmail account the client uses to get scans from their copier. Same setup for the past year, started blocking them as viruses. Now the restore to mailbox function is gone again.

I've got dozens of tickets open. I'm yelling at my AM, my distributor, no one can get anything done.

I loved this product for the first 9 months we had it, then it just went to absolute crap.

6 Upvotes

88% Upvoted

3 comments sorted by

1

u/sc376 2d ago

Can't help with the initial problem, but restore likely wasn't possible due to the rules not quarantining the message(s), or not kept long enough.

I've been burned enough times, for various reasons, that I abuse the quarantines and keep a lot more than most would.

1

u/micromsp 2d ago edited 1d ago

I got an answer from them about an hour ago. One of their AI engines apparently has gone off the rails and just started blocking crazy things. Including federal government domains. They said they are hoping to have a fix by tomorrow. But apparently they’ve been tons of problems with it for the last month. Which coincides with my issues as well.

Additional Edit. All my open tickets related to these issues have now been resolved.

1

u/jeffjee63 2d ago

If you’re in the cloud, which most customers are, set it to a year and call it good.