topic Re: Virus/win32.wgeneric.ajgdai id 341892366 in General Topics

Virus/win32.wgeneric.ajgdai id 341892366

abdulhakam — Tue, 28 Apr 2020 08:08:50 GMT

Hi Team,

I have issue. One user connect to SSL VPN, and cannot ping one IP 192.168.1.11. Only one IP. after i checking at firewall, I found this users got blocking activity Threat Name virus/win32.wgeneric.ajgdai id 341892366. But when this users using mobile hotspot. him can ping this IP address 192.168.1.11.

Palo Alto PA-220

Thanks

Re: Virus/win32.wgeneric.ajgdai id 341892366

OtakarKlier — Tue, 28 Apr 2020 19:14:51 GMT

Hello,

Where is the IP he is trying to ping, on his network or on yours behind the VPN?

Please advise,

Re: Virus/win32.wgeneric.ajgdai id 341892366

abdulhakam — Wed, 29 Apr 2020 23:19:21 GMT

HIi @OtakarKlier

Thanks for reply.

He at home try to ping IP at the their office(Window server 2016) . At the office have Palo Alto firewall. I checked at firewall log, and found have threat from IP address this users.

I not sure, this threat have connection from his problem or not.

Because him problem is, cannot ping (window server 2016) when use VPN from him modem wifi, but if he using mobile hotspot and use same VPN account , he can ping all server at the office (window server 2016).

So what a question is, I found threat from log firewall from account VPN same (Personal cannot ping window server 2016), Is there a problem with the threat from log firewall ?

Thanks

#log threat
-Virus/Win32.WGeneric.ajgdai 341892366
-application ms-ds-smbv3
- port 445

Re: Virus/win32.wgeneric.ajgdai id 341892366

OtakarKlier — Thu, 30 Apr 2020 16:02:35 GMT

Hello,

Is ping allowed? Is the users IP on the block list for a threat, if that is setup?

Regards,

Re: Virus/win32.wgeneric.ajgdai id 341892366

abdulhakam — Fri, 01 May 2020 08:08:06 GMT

Hello,

Yes it allowed to ping or access or remote. Other staff can.. just him cannot ping..

Is the users IP on the block list for a threat, if that is setup? NO.

Just him cannot ping when using wifi at home.

My question is, this problem related for threat log from firewall.? below screen shot log firewall.

Re: Virus/win32.wgeneric.ajgdai id 341892366

OtakarKlier — Fri, 01 May 2020 14:58:00 GMT

Hello,

I would say investigate that node to see what is causing the alert in the AV logs. Sounds like it may be compromised?

Regards,