Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Trojan.Sasfis

Subscribe

Check Point Reference: CPAI-2010-085
Date Published:
Severity:
Source: Check Point Malware Research Team
Protection Provided by: Security Gateway
  • R71
  • R70
Who is Vulnerable?
Microsoft Windows clients
Vulnerability Description
Malware is a software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general name for a variety of forms of hostile, intrusive, or annoying programs like Viruses, worms, Adware, Trojans, and spyware that exploit unprotected clients, using network access to intrude upon organizations, destroying or stealing data.

A Trojan horse is a program that installs malicious software while under the guise of doing something else.  Trojans are known for installing backdoor programs which allow unauthorized non permissible remote access to the victim's machine by unwanted parties with malicious intentions.

Vulnerability Details
Trojan.Sasfis is a Trojan Dropper that is being distributed via spam E-mail.

Protection Overview
The protection is able to detect and block the malware based on pre-defined header names.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Web Intelligence > HTTP Protocol Inspection.
2. In the right pane, double-click the Header Rejection protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect).
4. Under Additional Settings > Header Rejection, enable the following protection:

Trojan: Trojan.Sasfis

5. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Header Rejection
Attack Information: Trojan: Trojan.Sasfis