> Source: [sk109130](https://support.checkpoint.com/results/sk/sk109130)

# sk109130 - Anti-Virus blade does not scan, block or detect files known as malware

| Property | Value |
|----------|-------|
| Solution ID | sk109130 |
| Date Created | 2016-01-06 |
| Last Modified | 2016-01-07 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Anti-Virus does not block files, known as malwares via SMTP/HTTP.  

* No logs about detection or prevention of the files are created, which means files passes successfully to the other side.  

* Anti-Virus kernel debug (`fw + malware, CI + all`) shows:  

  rad_kernel_av_request_set_extension: extension is empty;  
  .  
  {global} rad_kernel_av_request_print: file type id=0  
  .  
  {global} av_is_common_file_type: file type id 0 is common;  
  .  
  {global} av_ldb_tbl_get: going to look for md5 in ldb, len = 16  
  .  
  {global} av_ldb_tbl_get: md5 not found in ldb, kiss ret=-1  
  .  
  {global} rad_kernel_api_get_cached_resource: done: _client_id=5, _service=5 _request=e96c0800 _response=ef7fadc8, status='ok'  

* Local scan \[with `/opt/KAV/test_sync`\] shows files as malicious, yet they are passing.  

  Example:  

  `'?`**file-absolote-location** `?': EVENT_DETECT '?`**name-of-virus** `?'. Detect type: KDT_TROJWARE, Detect danger: KDD_HIGH`  
  `
  '?`**file-absolote-location** `?': EVENT_CLEANFAILED`  
  `
  '?`**file-absolote-location** `?': EVENT_RESULT - INFECTED`  
  `
  Scanning succeeded. Scan result: infected`  
  `
  Uninitializing...done.`

## Cause

File that recognized by the engine as id=0, or file type id=0, are files that called "common" and not being scanned.

Due to that, kiss returned -1 \[kiss ret=-1\] and RAD kernel returned status='ok' - which bypassed the file inspection.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content