I had a friend bring over a PC for me to do a virus removal on. I wasn't thinking when I plugged it into my network. I fixed his PC by simple means. He went on his way. My system was left in chaos. I have tons of logs (below is just a sample) and I cannot connect outside the network. Everything is locked down. I thought it was from the ATP freaking out over what it found. This is a false positive situation. Any help would be appreciated.
"Hello Patrick
The UTM's ATP does not block whole hosts...it only blocks known bad connections. Everything else should work as expected. If you don't have access to internet, its something else. Maybe non working DNS, missing proxy and/or Masquerading rule, missing packetfilterrule, wrong / missing default gateway on affected system, wrongly enterend proxy settings in the web browser, somethings broken in the registry after cleanup etc.
However, ATP will not totally block connections from clients with ATP blocked traffic.
The red head from ATP will disappear after 72h after last trigger, but this is only cosmetic and should not shield a complete source host from internet access...
/Sascha "
logs:
1.8mb in system messages
-----------------------------------------------------------------------------------------------------
7.5mb in web filtering
------------------------------------------------------------------------------------------------------
3.5kb in User authentication daemon
------------------------------------------------------------------------------------------------------
SMTP proxy
C2/Generic-A
2015:02:18-00:01:02 sophos /usr/sbin/cron[31634]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-00:02:01 sophos /usr/sbin/cron[31692]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-00:04:01 sophos /usr/sbin/cron[31823]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-00:05:01 sophos /usr/sbin/cron[31864]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:07:01 sophos /usr/sbin/cron[32295]: (root) CMD (/sbin/audld.plx --trigger)
2015:02:18-00:10:02 sophos /usr/sbin/cron[32468]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:10:02 sophos /usr/sbin/cron[32471]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-00:14:01 sophos /usr/sbin/cron[32652]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-00:15:01 sophos /usr/sbin/cron[32700]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:16:01 sophos /usr/sbin/cron[311]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-00:17:01 sophos /usr/sbin/cron[365]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-00:20:01 sophos /usr/sbin/cron[509]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:20:01 sophos /usr/sbin/cron[512]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-00:22:01 sophos /usr/sbin/cron[954]: (root) CMD (/sbin/audld.plx --trigger)
2015:02:18-00:24:01 sophos /usr/sbin/cron[1097]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-00:25:01 sophos /usr/sbin/cron[1135]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:30:01 sophos /usr/sbin/cron[1343]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-00:30:01 sophos /usr/sbin/cron[1344]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:31:01 sophos /usr/sbin/cron[1435]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-00:32:01 sophos /usr/sbin/cron[1490]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-00:34:01 sophos /usr/sbin/cron[1596]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-00:35:01 sophos /usr/sbin/cron[1639]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:37:01 sophos /usr/sbin/cron[2068]: (root) CMD (/sbin/audld.plx --trigger)
2015:02:18-00:40:02 sophos /usr/sbin/cron[2243]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
----------------------------------------------------------------------------------------------------------------------------
2015:02:18-00:00:04 sophos smtpd[31216]: Reset password: Connecting to Confd was successful.
2015:02:18-00:00:04 sophos smtpd[31216]: Reset password: Confd returned the expected expiry period: 30 day(s).
2015:02:18-00:00:05 sophos smtpd[31216]: Reset password: Expired passwords successfully deleted.
2015:02:18-00:00:05 sophos smtpd[31211]: Expired letters: Removing letters from SPX Portal that are older than 30 days...
2015:02:18-00:00:05 sophos smtpd[31211]: Expired letters: There was an error while removing expired letters:
2015:02:18-00:01:00 sophos exim-out[31593]: 2015-02-18 00:01:00 Start queue run: pid=31593
2015:02:18-00:01:00 sophos exim-out[31593]: 2015-02-18 00:01:00 End queue run: pid=31593
2015:02:18-00:02:01 sophos exim-out[31683]: 2015-02-18 00:02:01 Start queue run: pid=31683
2015:02:18-00:02:01 sophos exim-out[31683]: 2015-02-18 00:02:01 End queue run: pid=31683
2015:02:18-00:03:00 sophos exim-out[31789]: 2015-02-18 00:03:00 Start queue run: pid=31789
2015:02:18-00:03:00 sophos exim-out[31789]: 2015-02-18 00:03:00 End queue run: pid=31789
2015:02:18-00:04:00 sophos exim-out[31807]: 2015-02-18 00:04:00 Start queue run: pid=31807
2015:02:18-00:04:00 sophos exim-out[31807]: 2015-02-18 00:04:00 End queue run: pid=31807
2015:02:18-00:05:00 sophos exim-out[31850]: 2015-02-18 00:05:00 Start queue run: pid=31850
2015:02:18-00:05:00 sophos exim-out[31850]: 2015-02-18 00:05:00 End queue run: pid=31850
2015:02:18-00:06:00 sophos exim-out[31921]: 2015-02-18 00:06:00 Start queue run: pid=31921
2015:02:18-00:40:02 sophos /usr/sbin/cron[2244]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-00:44:01 sophos /usr/sbin/cron[2431]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-00:45:01 sophos /usr/sbin/cron[2474]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:46:01 sophos /usr/sbin/cron[2553]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-00:47:01 sophos /usr/sbin/cron[2608]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-00:50:01 sophos /usr/sbin/cron[2752]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-00:50:01 sophos /usr/sbin/cron[2753]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-00:52:01 sophos /usr/sbin/cron[3209]: (root) CMD (/sbin/audld.plx --trigger)
2015:02:18-00:54:01 sophos /usr/sbin/cron[3362]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-00:55:01 sophos /usr/sbin/cron[3403]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:00:01 sophos /usr/sbin/cron[3619]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:00:01 sophos /usr/sbin/cron[3631]: (root) CMD ( /usr/local/bin/rpmdb_backup )
2015:02:18-01:00:01 sophos /usr/sbin/cron[3634]: (root) CMD ( /var/chroot-httpd/var/webadmin/extra/httpd_session_cleanup)
2015:02:18-01:00:01 sophos /usr/sbin/cron[3635]: (root) CMD (/sbin/hwclock --systz --utc)
2015:02:18-01:00:01 sophos /usr/sbin/cron[3636]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-01:01:01 sophos /usr/sbin/cron[3763]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-01:02:01 sophos /usr/sbin/cron[3829]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-01:04:01 sophos /usr/sbin/cron[3938]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-01:05:01 sophos /usr/sbin/cron[3983]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:05:01 sophos /usr/sbin/cron[3984]: (root) CMD (/var/chroot-afc/app_accuracy/scripts/collect.plx)
2015:02:18-01:07:01 sophos /usr/sbin/cron[4437]: (root) CMD (/sbin/audld.plx --trigger)
2015:02:18-01:10:01 sophos /usr/sbin/cron[4621]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:10:01 sophos /usr/sbin/cron[4622]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-01:14:01 sophos /usr/sbin/cron[4804]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-01:15:01 sophos /usr/sbin/cron[4847]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:16:01 sophos /usr/sbin/cron[4925]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-01:17:01 sophos /usr/sbin/cron[4979]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-01:20:01 sophos /usr/sbin/cron[5127]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-01:20:01 sophos /usr/sbin/cron[5135]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:21:01 sophos /usr/sbin/cron[5235]: (root) CMD (/usr/local/bin/lirm.plx)
2015:02:18-01:22:01 sophos /usr/sbin/cron[5726]: (root) CMD (/sbin/audld.plx --trigger)
2015:02:18-01:24:02 sophos /usr/sbin/cron[6074]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-01:25:01 sophos /usr/sbin/cron[6103]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:30:01 sophos /usr/sbin/cron[6314]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:30:01 sophos /usr/sbin/cron[6318]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-01:30:01 sophos /usr/sbin/cron[6319]: (root) CMD (/usr/local/bin/logcleaner.plx -e)
2015:02:18-01:31:01 sophos /usr/sbin/cron[6424]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-01:32:02 sophos /usr/sbin/cron[6484]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-01:34:02 sophos /usr/sbin/cron[6588]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-01:35:01 sophos /usr/sbin/cron[6622]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:37:01 sophos /usr/sbin/cron[7056]: (root) CMD ( /var/storage/chroot-pop3/bin/pop3dump.sh)
2015:02:18-01:37:01 sophos /usr/sbin/cron[7057]: (root) CMD (/sbin/audld.plx --trigger)
2015:02:18-01:39:01 sophos /usr/sbin/cron[7313]: (root) CMD (/var/chroot-afc/app_accuracy/scripts/collect.plx popularity)
2015:02:18-01:39:33 sophos postgres[7344]: [3-1] WARNING: pgstat wait timeout
2015:02:18-01:39:50 sophos postgres[7364]: [3-1] WARNING: pgstat wait timeout
2015:02:18-01:39:56 sophos postgres[3712]: [3-1] WARNING: pgstat wait timeoutFeb 18 01:40:08 postgres[3712]: [4-1] WARNING: pgstat wait timeout
2015:02:18-01:40:20 sophos postgres[3712]: [5-1] WARNING: pgstat wait timeout
2015:02:18-01:40:01 sophos /usr/sbin/cron[7382]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-01:40:01 sophos /usr/sbin/cron[7383]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:40:08 sophos postgres[7365]: [3-1] WARNING: pgstat wait timeout
2015:02:18-01:40:19 sophos postgres[7391]: [3-1] WARNING: pgstat wait timeout
2015:02:18-01:40:31 sophos postgres[3712]: [6-1] WARNING: pgstat wait timeout
2015:02:18-01:40:44 sophos postgres[3712]: [7-1] WARNING: pgstat wait timeout
2015:02:18-01:40:30 sophos postgres[7402]: [3-1] WARNING: pgstat wait timeout
2015:02:18-01:40:42 sophos postgres[7414]: [3-1] WARNING: pgstat wait timeout
2015:02:18-01:43:10 sophos postgres[7493]: [3-1] WARNING: pgstat wait timeout
2015:02:18-01:43:44 sophos postgres[3712]: [8-1] WARNING: pgstat wait timeout
2015:02:18-01:44:05 sophos /usr/sbin/cron[7527]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-01:44:08 sophos postgres[3712]: [9-1] WARNING: pgstat wait timeout
2015:02:18-01:45:02 sophos /usr/sbin/cron[7577]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:46:01 sophos /usr/sbin/cron[7657]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-01:47:01 sophos /usr/sbin/cron[7710]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-01:50:01 sophos /usr/sbin/cron[7851]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-01:50:01 sophos /usr/sbin/cron[7852]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-01:52:01 sophos /usr/sbin/cron[8294]: (root) CMD (/sbin/audld.plx --trigger)
2015:02:18-01:54:01 sophos /usr/sbin/cron[8437]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-01:55:01 sophos /usr/sbin/cron[8475]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-02:00:02 sophos /usr/sbin/cron[8688]: (root) CMD ( /usr/local/bin/rpmdb_backup )
2015:02:18-02:00:02 sophos /usr/sbin/cron[8698]: (root) CMD (/sbin/hwclock --systz --utc)
2015:02:18-02:00:02 sophos /usr/sbin/cron[8699]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2015:02:18-02:00:02 sophos /usr/sbin/cron[8694]: (root) CMD ( /usr/local/bin/reporter/system-reporter.pl)
2015:02:18-02:00:02 sophos /usr/sbin/cron[8696]: (root) CMD ( /var/chroot-httpd/var/webadmin/extra/httpd_session_cleanup)
2015:02:18-02:01:01 sophos /usr/sbin/cron[8837]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_feedback_uploader)
2015:02:18-02:02:01 sophos /usr/sbin/cron[8892]: (root) CMD ( nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2015:02:18-02:04:01 sophos /usr/sbin/cron[8998]: (httpproxy) CMD (/var/chroot-http/usr/bin/virus_sample_uploader -p /var/chroot-http)
2015:02:18-02:05:02 sophos /usr/sbin/cron[9041]: (root) CMD ( /usr/localFeb 18 14:33:52 aua[16825]: id="3004" severity="info" sys="System" sub="auth" name="Authentication successful" srcip="192.168.1.123" host="" user="admin" caller="webadmin" engine="local"
2015:02:18-15:24:16 sophos aua[3388]: id="3006" severity="info" sys="System" sub="auth" name="Child 16825 is runnin
This thread was automatically locked due to age.
