Views:
SolutionOPR / POLICY
PE_FLOXIF.SM-O11.127.00
PE_FLOXIF.D15.299.00
Behavior Monitoring (TMTD)PA4734S

Containment

  1. Check how many endpoints are affected by doing the following.
    1. Filter Virus Logs / Anti-Malware Events by their detection name.
    2. Create a Pivot Table similar to the following.

      Pivot Table 1

      Click the image to enlarge.

  2. Identify Infection sources by filtering through Source Host which can be done either on the pivot table or on the web portal.

    Pivot Table 2

    Click the image to enlarge.

  3. Isolate the endpoints for cleanup.
  4. For a larger outbreak, Outbreak Prevention Policies can be utilized.

Cleanup

For Endpoints with functional and updated Security Software:

  1. Configure Real Time Scan, Scheduled Scan, Manual Scan, and Scan Now with the following Settings.
    • Set scan target to "All scannable files".

      Files to Scan

      Click the image to enlarge.

    • Set scan actions to customized actions.

      Virus Malware

      Click the image to enlarge.

    • Remove scan exclusions.

      Scan Exclusion

      Click the image to enlarge.

  2. Perform a network-wide scan.

For Isolated Endpoints or Endpoints without Functional AV Software:

  • Option 1: ATTK Offline Clean Tool
    1. Download Trend Micro Anti-Threat Toolkit – Offline Clean Tool:

      32-bit
      64-bit

    2. Since the malware infects .exe files, change the extension of the tool to .com. It is recommended to run it inside C:\Windows\.
    3. Click Fix on the detected items, and click Restart once prompted.

      Threat Toolkit

      Click the image to enlarge.

  • Option 2: Trend Micro Rescue Disk
    1. For Cleanup choose Scan for Security Threats.

      Security Threats 1

      Click the image to enlarge.

    2. Perform a Full Scan.

      Security Threats 2

      Click the image to enlarge.

    3. A message should appear once the files are cleaned. For files that are not cleaned, this can be deleted manually or sent to Trend Micro for analysis.

      Security Threats 3

      Click the image to enlarge.