ASP/WebShell.CL!tr ASP/WebShell.CL!tr is a generic detection for a trojan. This malware has been associated with the following Hafnium article/advisory: https://fndn.fortinet.net/FortiGuard-Alert-Outbreaks/Hafnium-Fabric-View/ The correlation has been established due to a database near/exact match on one of the sample/IOC/file hash indicated in the mentioned resource. md5: 1a7a85b0390b308b1801679e11567eac sha256: 406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928 A quick view of this ASP code indicates the following: a set of server commands : "CONNECT", "DISCONNECT", "FORWARD", "READ" a server default response of "Georg says, 'All seems fine"
Make sure that your FortiGate/FortiClient system is using the latest AV database.
Quarantine/delete files that are detected and replace infected files with clean backup copies.
