ESOD found malware, but no other product can find it.

[Srdjan_B]

Hi,

customer has deployed SSL VPN with ESOD for external contractors and it has been working fine for some time. One contractor started getting warning that spyware was found on his PC (Windows 10) and he cannot access customer's VPN anymore. This would have been expected, if the PC was really infected. However, contractor used number of tools to check for malware, he has followed sk106019 and cannot find any issues with the PC. Everything used to work some time ago, he was able to pass ESOD scan with that same PC earlier.

So, a simple question: if ESOD found infected file, where can we get the filename/path of infected file(s)? It is not displayed in Smart Log (and logging is already set to Details). Is there any log on the client PC itself? 

If it matters, the spyware name (as reported by SmartLog) is Win32.Spyware.Fake.Presto.B and GW is running R80.20 with JHF T103.

Thank you

[PhoneBoy]

This may very well be a false positive, though can't say for sure.
Recommend engaging with the TAC for further analysis.

[the_rock]

Are they using actual client or this is simply clientless VPN? If its clientless VPN (old SNX), then not so sure logs would be easy to find locally. If they are using the client, logs would be present via gui option.

Andy