https://community.checkpoint.com/t5/Firewall-and-Security-Management/Check-the-correctness-of-Threat-Prevention/m-p/224736#M54117 <P>Open a SR# with CP TAC to get help for this !</P> Wed, 28 Aug 2024 08:02:01 GMT G_W_Albrecht 2024-08-28T08:02:01Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Check-the-correctness-of-Threat-Prevention/m-p/224711#M54115 <P>Dear Guy!</P><P>Currently on our Threat Prevention interface there are some logs related to Check Point scanning traffic and found some machines infected with Ramnit Bot.</P><P>However, under the desktop we used Trend Micro and deep scan but could not find this bot. Is Check Point showing it correctly?</P><P>How can we find this Bot and clean with it.</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2024-08-28_103331.png" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/27363iF5435FFD1B9834D3/image-size/large?v=v2&amp;px=999" role="button" title="2024-08-28_103331.png" alt="2024-08-28_103331.png" /></span></P> Wed, 28 Aug 2024 03:37:18 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Check-the-correctness-of-Threat-Prevention/m-p/224711#M54115 MarcuzShinz 2024-08-28T03:37:18Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Check-the-correctness-of-Threat-Prevention/m-p/224728#M54116 <P>- open the relevant packet captures in the traffic logs (most of the time there is a packet capture)</P> <P>with this capture you can find more info related to this Ramnit.</P> <P>Also reflect the information with this article:</P> <P><A href="https://community.checkpoint.com/t5/Threat-Intelligence-Reports/sLoad-Delivering-Ramnit/ba-p/175" target="_blank">https://community.checkpoint.com/t5/Threat-Intelligence-Reports/sLoad-Delivering-Ramnit/ba-p/175</A></P> <P><A href="https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.ramnit.a" target="_blank">https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ramnithttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.ramnit.a</A></P> <P>I suspect false positive because Ramnit is from 2011 and came back years after in a modified version</P> Wed, 28 Aug 2024 07:28:38 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Check-the-correctness-of-Threat-Prevention/m-p/224728#M54116 Lesley 2024-08-28T07:28:38Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Check-the-correctness-of-Threat-Prevention/m-p/224736#M54117 <P>Open a SR# with CP TAC to get help for this !</P> Wed, 28 Aug 2024 08:02:01 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Check-the-correctness-of-Threat-Prevention/m-p/224736#M54117 G_W_Albrecht 2024-08-28T08:02:01Z