topic Re: Malware deducted in Spark Firewall (SMB)

Malware deducted

humt — Sun, 27 Oct 2019 10:16:24 GMT

I am using the Checkpoint 730 with latest firmware 86.

Few queries in my mind

1) Malware has been Infected. I am not sure it has been removed automatic or not.

2) How system has been infected when internet is pass through the firewall only.

3) I have scan with kaspersky Antivirus but the infected system has been not deducted the malware. So i have to install Bitdefender for remove the malware because there are 4 results which deducted as Malware according to Virustotal?

Sorry if this is in wrong category section, please move this thread to another category.

Re: Malware deducted

Nick_Doropoulos — Sun, 27 Oct 2019 11:57:09 GMT

Hello,

Assuming you have eliminated the possibility of a false positive by consulting VirusTotal and Hybrid Analysis, please see answers to your questions below:

1) Check Point have created sk106019 to cleanup infected systems. Feel free to follow it and advise results.

2) There are usually multiple infiltration channels through which malware can be delivered. The affected host could have been infected in a number of different ways; including from internally as well. Since you use Bitdefender for EDR, I would advise that you investigate the delivery method as it should be shown in an illustrated, graphic way (that is something I have done myself in the past).

3) You can remove it with Bitdefender but again, you should also be able to achieve the same result with the sk mentioned in step 1.

I hope this helps.

Re: Malware deducted

humt — Thu, 31 Oct 2019 13:28:24 GMT

This is a Malware and how would it enter into system. This is main issue for me. I have send the details to Kasperksy Lab also. And they told this has been included as virus now. I have to format the system now because it is being corrupted the system firewall also.

Re: Malware deducted

G_W_Albrecht — Thu, 31 Oct 2019 14:41:25 GMT

What do you mean with latest firmware 86 ? Latest firmware is 77.20.87, newest build is the R77.20.87 Jumbo Hotfix Accumulator Build 2960 and is available in sk153433.

Re: Malware deducted

humt — Fri, 01 Nov 2019 14:49:04 GMT

Strange it is not updating automatic. I have checked it for manually update but it shows 86 is only the latest version. Let me download and update manually. Thanks