Release / Whitelist False positive Virus

[tabootest]

Hi,
We are using EFA 3.0.0.8.
Emails from One of our customers are blocked and identifed with virus winnow.spam.ts.stock.10.UNOFFICIAL
The emails are safe and we could open with gmail and hotmail eamil.

1. How could we whitelist her emails?
2. Also, how could we confiure EFA to perform in-dept scan for zip / rar files to prevent .locky email?

Many thanks.

[pdwalker]

2/ See here for the necessary configuration change.

1/ How do you know the customer is really sending safe emails? Do the affected emails from the customer contain word documents?

[tabootest]

Thanks for your reply.

The email is virus-free with other virus scanners, also, the email is presented correctly in yahoo and google email account.
Is there any alternative to whitelist this false positive identification.

Thanks.

[pdwalker]

is it just this one message, or does it happen with every message sent?

[tabootest]

it happens to every messages from one specific customer and labelled as winnow.spam.ts.stock.10.UNOFFICIAL.

thanks.

[pdwalker]

would you be willing and able to have them send messages to two addresses I specify so I could diagnose it further?