Win32.Conficker.C p2p-block

[jdprovine]

Is it possible to block this spyware specifically Win32.Conficker.C p2p and where it the best place to do it?

[bmorris1]

Hello jprovine,

You can configure an anti-virus profile to block this. You can check if PAN cover it by looking in the threat vault.

https://threatvault.paloaltonetworks.com/

I've already checked and the devices do cover it so make sure your anti virus version is up to date and you can apply an anti-virus profile to a security rule in order to defend against this virus.

You can use the guide to help you configure it.

PAN-OS Administrator's Guide 6.1 (English)

thanks,

Ben

[jdprovine]

Okay well according the Admin guide there are two ways to do this by creating a rule or going to the exception tab and adding specific signatures with specific actions I am not sure which is the best route to go. Any one have any preferences.

[jdprovine]

Okay even though I set this item to be blocked it isn't, Anyone have a clue why it is still just alerting?

[bmorris1]

Hello jprovine,

Can you try blocking this with a anti virus profile rather than a anti spyware profile, on the threatvault it is covered as a virus.

thanks,

Ben

[jdprovine]

I can try but it doesn't list it as a virus but as spyware in the program and I checked it in the threat vault as well and it listed it as spuware

[bmorris1]

Hi jprovine,

Here is a link to the virus detail

https://threatvault.paloaltonetworks.com/Home/VirusDetail/2606334

If you are testing through an encrypted connection, can you make sure you have decryption enabled.

thanks,

Ben

[jdprovine]

I am not using decryption and I would think if it were encrypted I wouldn't be able to alert on it either. But you have some good thoughts

[mmmccorkle]

I believe he was referring to SSL Decryption, yeah?

[jdprovine]

I don't know mmmccorkle not sure what difference that would make can you elaborate

[jdprovine]

I had to go in to the exception tab and set it there and then it worked