mxHERO Shares Malware Detection

mxHERO scans every file stored in mxHERO Shares for malware. This page explains what happens when a threat is found, who is told, and how to review a detection and release a file that you're sure is safe.

Before you begin

• You need an Owner or Administrator role in the Admin Dashboard.
• To receive malware alerts by email, turn on Storage errors in Settings › Notifications. See Notification Settings.

How detection works

A file with a threat is blocked for everyone until an administrator ignores the threat.

When a scan finds a threat:

• The file is blocked. It can no longer be downloaded, previewed or shared. Every share of that file is affected, including copies of the same content sent in other emails.
• Recipients of a link to that file see "The file does not exist or has expired". In a shared folder, the infected file is left out of the list.
• The file owner gets an email and a notice in the End User App (see below).
• Administrators get a malware-detected notification (type Storage, level Error) in Reports › Notifications, and the detection is listed in mxHERO Shares › Malware.

What the file owner receives

The owner of each blocked file gets one email per detection from noreply@notifications.mxhero.com, in your organization's language (English, Japanese or French):

• Subject: "Malware detected in your mxHERO file: {file name}" (or "Malware detected in {n} of your mxHERO files" for several files).
• The threat name, the detection time (UTC), and each file with its folder and an Open folder in mxHERO link to the End User App.
• A note that, for a false positive, they should contact your organization's administrator.

The same notice appears in the Notifications section of the End User App. If the owner opens the file there, they see the threat but can't preview or download it.

Note: Tell your users that you, not mxHERO support, review false positives. Owners are told to contact their administrator.

Review detections

1. Open mxHERO Shares › Malware.

   If nothing has been detected, the page shows No malware detected.

   

2. Review the list. Each detection shows the threat, the detection date, the number of files and the users whose files contain it, and whether it has been released.

3. Use the search box to find a threat name, owner, folder path or file name. Use the released filter to show or hide items you already handled.

4. Click a detection to open it. The details show:

   • the file: name, folder path, owner, last update and content checksum;
   • the scan result: threat name and detection time;
   • the email the file arrived with: From, To, Cc, Subject, Date and Message-ID.

Opening a detection records that you viewed it.

Download a blocked file for analysis

If your security team needs to analyze the file:

1. Open the detection.
2. Click Download.
3. Read the warning and confirm.

The download link is valid for 5 minutes.

Warning: The file contains a detected threat. Download it only to an isolated analysis environment, never to a regular workstation.

Release a false positive

Release a file only when you're sure the detection is wrong, for example after your security team has checked it.

1. Open the detection in mxHERO Shares › Malware.
2. Click Ignore threat.
3. Read the dialog. It tells you how many other files share the same content.
4. Confirm.

The content is unblocked everywhere: every file and share with the same content works again, for all users and recipients. The action is recorded in Reports › User Activity as Threat ignored, with your name.

Warning: Releasing a threat unblocks the same content in every share and every user's folder, not just the one file you opened. If you're not sure, leave it blocked and ask the sender to send a clean copy.

Verify

• After releasing a file, open one of its share links. It should open normally.
• Check Reports › User Activity for a Threat ignored event. See User Activity.

Troubleshooting

Related pages

• mxHERO Shares Overview
• Recipient Experience
• Notification Error Codes
• User Activity
• Managing Shared Files