Tracking an infected computer

cancel
Showing results for 
Search instead for 
Did you mean: 

Tracking an infected computer

L2 Linker

I got a notice from my ISP that we have a Conficker infected system (downadup) but I am coming up with nothing when I try to find it.  The less than helpful info I recieve is the first octet of the target IP (38) and source port 61494, which map to hundreds of system.  I also have a destination port of 80, again very helpful.  The firewall is NATing for about 2000 systems.  Has anyone used their panos box to track a system before and if so what did you do?  We have ESET deployed for anti-virus and it is not showing anything right now.  We could be missing a system though.  I am still fairly new to my PA-3020 box so use small words please.

I have been using the threat log and tried the pre-built reports.  The Monitor Logs are amazing but I can't seem to narrow the search enough to find the problem.  I only have the URL filter and threat prevention license on 5.0.9

Thanks,

Todd

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

Hello Todd

The simplest way is to make a filter in Thread log

2014-01-04_182054.png

I'm not sure that every variant of Conficker has 12544 id, so You can remove "and ( threatid eq 12544 )"

Of course You mast have Thret prevention profile added to security rule that is allowing traffic from You networks to Internet.

Regards

SLawek

View solution in original post

3 REPLIES 3

L7 Applicator

Hello Todd,

Is there any related information pops up under Monitor > Threat logs...?

Also please apply below mentioned command to stop suppressing repetitive logs on PAN FW.

# set deviceconfig setting logging log-suppression no


Thanks

L4 Transporter

Hello Todd

The simplest way is to make a filter in Thread log

2014-01-04_182054.png

I'm not sure that every variant of Conficker has 12544 id, so You can remove "and ( threatid eq 12544 )"

Of course You mast have Thret prevention profile added to security rule that is allowing traffic from You networks to Internet.

Regards

SLawek

View solution in original post

Thanks SLawek,

I finally figured it out with your help.  I ran the Threats report and found all the Suspicious DNS Query results I had been unable to find before.  Each one has a different ID code that I was able to search for in the Threat log as you describe with great success.  Looks like I should be able to trace this after all.

ThreatIDs.PNG.png

-Todd

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!