- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
06-17-2014 12:28 PM
Hello
Last days one of my computer started generating strange traffic that is blocked by Thread Prevention (ID35111)
I have access to this computer, but how to find and remove this program that is genrating such traffic?
Regards
Slawek
06-18-2014 01:40 PM
Slawek,
You might start by looking at the netstat output for the workstation with the source port 65409
This article will help for a Windows system - See what process is using a TCP port in Windows Server 2008 - TechRepublic
The SysInternals tools from Microsoft can also help - Windows Sysinternals: Documentation, downloads and additional resources
One issue that may arise is that modern malware tends to hide itself from the built in tools that could be used to identify it.
May your efforts be successful.
James
06-24-2014 12:28 PM
Today I did execption in volnurability profile with pcpap option set.
In Thread log I see:
In Monitor>Packe Capture > Captured files there isn't such file.
How to save this information in .pcap format file?
How can I use this information for sending it for further analysis by other vendors?
With regards
SLawek
06-25-2014 12:14 AM
Hi slv,
To save the pcap you should use the 'Export' button provided:
In Monitor>Packet Capture > Captured files you will only find PCAP files which you have grabbed using the filters on that same page or via CLI using the 'debug dataplane packet-diag' command.
Kind regards,
-Kim.
06-25-2014 02:48 AM
Hello Kim
oops I guess I was blind!
Thx
Slawek
07-01-2014 03:26 AM
FYI
This traffic was generated by AmmyAdmin
Unfortunetelly PAN doesnt detect this traffic as should be. AmmyADmin is well known for PAN OS aplication, but not properly detected on 6.0.2.
Case pending for update.
Slawek
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!