topic Re: Blocking action with Virus Threat, but can't find information in General Topics

Blocking action with Virus Threat, but can't find information

aveva_palo — Mon, 22 Mar 2010 14:33:11 GMT

Hi,

We have a user trying to access a website webinar and they are getting blocked with AV threat name Trojan/Js.Iframe.bgw ID: 259252. The details are as follows.

Log	THREAT
Type	virus
Receive Time	2010/03/22 14:03:23
Generation Time	2010/03/22 14:03:17
Threat Name	Trojan/Js.Iframe.bgw
Threat ID	259252
Direction	server-to-client
From Zone	FW_UplinkOutsid
To Zone	FW_UplinkInside
Attacker	4.53.17.200
Victim	10.0.99.20
From User
To User
From Port	80
To Port	3376
Protocol	tcp
Application	web-browsing
Action	deny
Severity	medium
Rule	Internet
Ingress I/F	ethernet1/5
Egress I/F	ethernet1/6
Log Action
Virtual System	vsys3
Session Id	461655
Count	1
Configuration Version	8
Category	any
Others	hpbroadband.com
SSL Decrypted	no
NAT Applied	no
Packet Capture	no
Captive Portal	no
Proxy Transaction	no
Serial #

Re: Blocking action with Virus Threat, but can't find information

swhyte — Tue, 23 Mar 2010 19:37:04 GMT

If you think this is a false positive you can set an exception for this by simply clicking on the threat name from the threat log, then click on "show" next to exceptions, the click on "add".

To pursue this further you will need to call into support so we can take look at this and perhaps refer this to engineering to correct our content.

Thanks

Re: Blocking action with Virus Threat, but can't find information

aveva_palo — Fri, 26 Mar 2010 11:21:17 GMT

this issue went after an AV and threat definition update.