topic Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A" in Firewall and Security Management

Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

Diego_Vigano — Mon, 20 May 2019 14:26:58 GMT

Hi,

yesterday, during automatic scheduled update, a protection named "Trojan.Win32.Password-Unencrypted.A" was installed blocking all http connection.

As a workaround I change the protection from "prevent" to "detect".

Now, I can't find the protection in my database nor in the wiki, what's happened? How can I know if hte protection was retired?

kr,

Diego

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

Omer_Shliva — Thu, 23 May 2019 08:27:17 GMT

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

jgaikwad — Mon, 20 May 2019 18:59:56 GMT

Having this same issue today and was stumped when I couldnt find the protection at all. Guessing I just need to reinstall policy and it will be fixed.

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

miguel — Tue, 21 May 2019 15:51:27 GMT

This impacted our network greatly as well. Will be opening a ticket to get a RCA. In the meantime, any details that can be shared here how this could have happened?

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

Diego_Vigano — Wed, 22 May 2019 11:58:49 GMT

Searching the protection name in the Anti-BOT and changing form "protect" to "detect" before it was removed from the protection list.

Product: Anti-Bot
Protection ID: 00004C9C0
Protection Name: Trojan.Win32.Password-Unencrypted.A
Severity: Critical
Confidence Level: Medium

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

Omer_Shliva — Thu, 23 May 2019 08:26:51 GMT

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

Diego_Vigano — Wed, 22 May 2019 14:36:31 GMT

I can't because now the protection is not in the list, anyway as in the samples below, i searched for the protection and changed Prevent to detect:

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

miguel — Wed, 22 May 2019 15:47:43 GMT

The action taken was "Redirect", I'm happy to share screenshot privately, I have support case number if you want.

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

phuocle — Thu, 23 May 2019 01:51:08 GMT

I get the same problem. How can we solve this?

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

RickLin — Thu, 23 May 2019 05:28:39 GMT

If you search and can find it, just change the Protection action from Prevent to Detect base on your Threat Prevention Profile.

Remember to install Threat Prevention policy to apply it.

It work for my customer at Monday.

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

TP_Master — Thu, 23 May 2019 06:18:39 GMT

Hi all,

After getting reports of issues with this protection it was removed from the Anti-Bot package, hence the fact you can't see it now when searching. Anyway it will not return in its current form.

HTH

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

Diego_Vigano — Thu, 23 May 2019 08:17:19 GMT

All,

I showed the solution in my first post (change the protection to "detect"), I rather wondered why it was not present in the Anti-BOT wiki on this link https://threatwiki.checkpoint.com/threatwiki/public.htm

I think it would be correct to flag it as a "retired" (similar as in the Microsoft's patches) and wrote something in the knowledgebase.

Consider that the impact on our company has been remarkable ...

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

jboco — Wed, 29 May 2019 14:06:12 GMT

Hi All,

I had the same issue last Monday, May 20th, 2019. But when I'm looking into the Protection list. I can't find it anymore?

Did anyone confirm if the protection has been retired?

Re: Anti-Bot protection "Trojan.Win32.Password-Unencrypted.A"

Omer_Shliva — Thu, 30 May 2019 17:05:30 GMT

This protection is no longer part of the Anti-Bot dynamic package.

Omer Shliva | Team Leader, AB Research Protections and IPS/AB Customer Focus Team