FTP: access suddenly blocked ("550 Virus Detected and Removed")

On all our shared servers we use an anti-virus solution to fight virus uploads via FTP and scripts. 

It enables the detection of any potential hacking of FTP accounts or simply the sending, either deliberately or otherwise, of files (Wordpress themes, fake plugins, etc.) containing malicious code or malware.

The virus scanner checks all files less than 1MB in size and prevents any virus / phishing / spam script / etc. from being uploaded. If detected, the password of the FTP account is automatically modified and the corresponding files on the server are locked (FTPban).

The FTP server then sends a message like the following to the FTP client:

550 Virus Detected and Removed: botnet.infomaniak.5.UNOFFICIAL

or

550 Virus Detected and Removed: winnow.botnet.ff.trojans.15900.UNOFFICIAL

Here is an extract of an FTP log when an FTP ban occurs:

Statut : Démarrage de l’envoi de C:UsersKevinAppz1CORE10k.EXECommande : TYPE IRéponse : 200 Type set to ICommande : PASVRéponse : 227 Entering Passive Mode (93,87,221,174,167,151).Commande : STOR CORE10k.EXERéponse : 150 Opening mode data connection for CORE10k.EXERéponse : 421 Virus Detected : winnow.malware.74169.UNOFFICIAL (This account is now disabled)Erreur : Echec du transfert du fichierStatut : Démarrage de l’envoi de C:UsersKevinAppz1CORE10k.EXEStatut : Récupération du contenu du dossier...Commande : PASVRéponse : 227 Entering Passive Mode (93,87,221,174,167,151).Commande : MLSDRéponse : 150 Opening ASCII mode data connection for MLSDRéponse : 226 Transfer completeErreur : Connexion interrompue par le serveurErreur : Connexion interrompue par le serveurErreur : Echec du transfert du fichier après avoir transféré 643 octets en 36 secondes

Manually launching a virus scan at any time: https://faq.infomaniak.com/857

Monitoring and solving faults in hosted scripts: https://faq.infomaniak.com/2326