Check the correctness of Threat Prevention

[MarcuzShinz]

Dear Guy!

Currently on our Threat Prevention interface there are some logs related to Check Point scanning traffic and found some machines infected with Ramnit Bot.

However, under the desktop we used Trend Micro and deep scan but could not find this bot. Is Check Point showing it correctly?

How can we find this Bot and clean with it.

[Lesley]

- open the relevant packet captures in the traffic logs (most of the time there is a packet capture)

with this capture you can find more info related to this Ramnit.

Also reflect the information with this article:

https://community.checkpoint.com/t5/Threat-Intelligence-Reports/sLoad-Delivering-Ramnit/ba-p/175

https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ramnithttps://www.trendmicro.com/vin...

I suspect false positive because Ramnit is from 2011 and came back years after in a modified version

[G_W_Albrecht]

Open a SR# with CP TAC to get help for this !