About mivaldi

mivaldi · ‎05-20-2020

Yes, no longer considered malicious.

mivaldi · ‎05-19-2020

Virus/Win32.WGeneric.ajruiw is disabled and will be removed from tomorrow's release of Antivirus. Please open a Support case to investigate the Vulnerability FP.

mivaldi · ‎05-19-2020

Submitted for analysis

mivaldi · ‎05-19-2020

Submitted for analysis

mivaldi · ‎05-19-2020

Sample no longer marked malicious.

mivaldi · ‎05-15-2020

This is a forum for non-customers to request WildFire reconsideration of malicious sample verdicts observed in VirusTotal, so it is not the right place to submit your question. Please open a Support case to have your issue investigated.

mivaldi · ‎05-15-2020

Submitted for analysis.

mivaldi · ‎05-15-2020

Please open a Support case to have us take a closer look.

mivaldi · ‎05-14-2020

There should be a lot of information in correlated log entries. At the very left of the threat log entry, you will see a magnifying glass icon. Click it and that will open the detailed log view. On the lower panel, you will see correlated log entries. You can see correlated traffic log entries, URL filtering log entries, and wildfire submissions as well as other possible entries. These other entries will exist if these additional features were properly configured to log an event.

mivaldi · ‎05-14-2020

Signature Release Hashes Name: Virus/Win32.WGeneric.ajbsuc Unique Threat ID: 341044866 Create Time: 2020-04-08 19:03:39 (UTC) Threat ID: 2565506 Current Release: 3348 (2020-05-13 UTC) First Release: 3312 (2020-04-08 UTC) 78487e9f4dcd78f24a8b863e5b4cf15b9a4fcb6a78f2a8477ad43fe5639e4a04 Signature Release Hashes Name: Virus/Win32.WGeneric.ajbecg Unique Threat ID: 340897548 Create Time: 2020-04-07 20:22:17 (UTC) Threat ID: 2005534 Current Release: 3348 (2020-05-13 UTC) First Release: 3311 (2020-04-07 UTC) c39cb7067c3c5c22802bafe4d54b3365b1f24bab864ba6ba75c3e069d96d09b0 Signature Release Hashes Name: Virus/Win32.WGeneric.aeqdlm Unique Threat ID: 295866360 Create Time: 2019-08-21 09:26:56 (UTC) Threat ID: 2636376 Current Release: 3348 (2020-05-13 UTC) First Release: 3079 (2019-08-22 UTC) 2c96ca9abb21a87e0967de6ef78f76083f3917ecf2ba5ed69acd044582b0e3dc 9a2fcee13a376a99a0856c226bdce391f357a9ba766236accc4f74a02103a5ba 214f934a95dc68bf17aba4acd7f66babc692c544a1fa848e80eb7d4fc7c4e3c1 0cfdb09b489b7003577bd905a541b514a74232b2e4d3f51b0bf62998106e5fec

mivaldi · ‎05-14-2020

The best way to investigate these would be to access the Threat Vault at https://threatvault.paloaltonetworks.com/ Search for the Threat ID's and find the SHA256 hashes of the samples tied to the signatures. You can then use the SHA256 hashes to research the samples on the internet. A good place to begin that research is http://virustotal.com If you believe the signatures are built based on WildFire false positives or potential Signature Collisions you can open a request with Support to investigate. If you know for sure that these triggers are false positives, and they're interrupting critical business tasks, you can opt to create an exception in your Antivirus profile. You can see instructions at https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/threat-prevention/create-threat-exceptions

mivaldi · ‎05-12-2020

Try this: # configure # delete deviceconfig system ssh # set deviceconfig system ssh ciphers mgmt aes256-ctr # set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256 # set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 256 # set deviceconfig system ssh session-rekey mgmt interval 3600 # set deviceconfig system ssh mac mgmt hmac-sha2-256 # commit # exit > set ssh service-restart mgmt

mivaldi · ‎05-12-2020

This sample is no longer considered malicious.

mivaldi · ‎05-12-2020

The reported sample is no longer considered malicious.

mivaldi · ‎05-11-2020

Submitted for analysis.

Member Since	‎04-03-2014 01:35 PM
Date Last Visited	‎04-24-2024 07:20 PM
Posts	746
Total Likes Received	163

Online Status	Online
Date Last Visited	‎04-24-2024 07:20 PM

About mivaldi

Re: False Positive: Virus/Win32.WGeneric.yeksq

Re: Virus/Win32.WGeneric.eachsz(597618885)

Re: Add Multiple DNS Suffixes

Re: Adobe Reader DC install being treated as a virus

Re: DHCP Options

Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.1.14

Re: How can I submit a false positive malicious file review by e-mail?

Re: NTP and Bittorrent traffic issue

Re: NTP and Bittorrent traffic issue

Re: NTP and Bittorrent traffic issue

Re: Output format for test/url-info-cloud and test/url-info-host

Re: Virus/Win32.WGeneric.eachsz(597618885)

Re: NTP and Bittorrent traffic issue

Re: NTP and Bittorrent traffic issue

Re: Add Multiple DNS Suffixes

Re: NTP and Bittorrent traffic issue

Trying to identify a threat by host contact attempts

Re: NEW: Incorrect detection of our Social Media Bot application v5

Re: case ID-01857601

Re: Detecting a specific Linux binary(ELF) file using a custom signature

Re: False positive report: Winstab

Re: Microsoft office/teams malicious traffic

Re: generic.ml

Re: False positive report: Winstab

Re: NEW: Incorrect detection of our Social Media Bot application v5

Re: Cisco Jabber - When connected to GP, calling starts having problems.

Re: NEW: Incorrect detection of our Social Media Bot application v5

Re: Malicious traffic blocked by PAN : Virus/Win32.WGeneric.ajbecg(34089754

Re: Malicious traffic blocked by PAN : Virus/Win32.WGeneric.ajbecg(34089754

Re: Malicious traffic blocked by PAN : Virus/Win32.WGeneric.ajbecg(34089754

Re: Malicious traffic blocked by PAN : Virus/Win32.WGeneric.ajbecg(34089754

Re: SSH protocol uses Weak key exchange algorithms in PA 500 for PAN OS 8.

Re: generic.ml

Re: False Positive: Outbyte PCRepair

Re: False Positive: Outbyte PCRepair

Unlock your full community experience!

About mivaldi