topic Re: Win32.Conficker.C p2p-block in General Topics

Win32.Conficker.C p2p-block

jdprovine — Tue, 28 Jul 2015 18:50:33 GMT

Is it possible to block this spyware specifically Win32.Conficker.C p2p and where it the best place to do it?

Re: Win32.Conficker.C p2p-block

bmorris1 — Tue, 28 Jul 2015 19:52:42 GMT

Hello jprovine,

You can configure an anti-virus profile to block this. You can check if PAN cover it by looking in the threat vault.

https://threatvault.paloaltonetworks.com/

I've already checked and the devices do cover it so make sure your anti virus version is up to date and you can apply an anti-virus profile to a security rule in order to defend against this virus.

You can use the guide to help you configure it.

PAN-OS Administrator's Guide 6.1 (English)

thanks,

Ben

Re: Win32.Conficker.C p2p-block

jdprovine — Wed, 29 Jul 2015 14:33:00 GMT

Okay well according the Admin guide there are two ways to do this by creating a rule or going to the exception tab and adding specific signatures with specific actions I am not sure which is the best route to go. Any one have any preferences.

Re: Win32.Conficker.C p2p-block

jdprovine — Wed, 29 Jul 2015 16:08:43 GMT

Okay even though I set this item to be blocked it isn't, Anyone have a clue why it is still just alerting?

Re: Win32.Conficker.C p2p-block

bmorris1 — Wed, 29 Jul 2015 16:35:10 GMT

Hello jprovine,

Can you try blocking this with a anti virus profile rather than a anti spyware profile, on the threatvault it is covered as a virus.

thanks,

Ben

Re: Win32.Conficker.C p2p-block

jdprovine — Wed, 29 Jul 2015 16:54:04 GMT

I can try but it doesn't list it as a virus but as spyware in the program and I checked it in the threat vault as well and it listed it as spuware

Re: Win32.Conficker.C p2p-block

bmorris1 — Wed, 29 Jul 2015 18:16:57 GMT

Hi jprovine,

Here is a link to the virus detail

https://threatvault.paloaltonetworks.com/Home/VirusDetail/2606334

If you are testing through an encrypted connection, can you make sure you have decryption enabled.

thanks,

Ben

Re: Win32.Conficker.C p2p-block

jdprovine — Wed, 29 Jul 2015 18:20:34 GMT

I am not using decryption and I would think if it were encrypted I wouldn't be able to alert on it either. But you have some good thoughts

Re: Win32.Conficker.C p2p-block

mmmccorkle — Thu, 30 Jul 2015 15:09:41 GMT

I believe he was referring to SSL Decryption, yeah?

Re: Win32.Conficker.C p2p-block

jdprovine — Thu, 30 Jul 2015 15:12:37 GMT

I don't know mmmccorkle not sure what difference that would make can you elaborate

Re: Win32.Conficker.C p2p-block

jdprovine — Thu, 30 Jul 2015 16:30:20 GMT

I had to go in to the exception tab and set it there and then it worked