Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Srdjan_B
Participant

ESOD found malware, but no other product can find it.

Hi,

customer has deployed SSL VPN with ESOD for external contractors and it has been working fine for some time. One contractor started getting warning that spyware was found on his PC (Windows 10) and he cannot access customer's VPN anymore. This would have been expected, if the PC was really infected. However, contractor used number of tools to check for malware, he has followed sk106019 and cannot find any issues with the PC. Everything used to work some time ago, he was able to pass ESOD scan with that same PC earlier.

So, a simple question: if ESOD found infected file, where can we get the filename/path of infected file(s)? It is not displayed in Smart Log (and logging is already set to Details). Is there any log on the client PC itself? 

If it matters, the spyware name (as reported by SmartLog) is Win32.Spyware.Fake.Presto.B and GW is running R80.20 with JHF T103.

Thank you

0 Kudos
2 Replies
PhoneBoy
Admin
Admin

This may very well be a false positive, though can't say for sure.
Recommend engaging with the TAC for further analysis.

0 Kudos
the_rock
Leader
Leader

Are they using actual client or this is simply clientless VPN? If its clientless VPN (old SNX), then not so sure logs would be easy to find locally. If they are using the client, logs would be present via gui option.

 

Andy

0 Kudos