UTM9 ATP has detected outgoin Botnet traffic on one machine, Scan and Clean can't remove it. What to do?

Can you post the log entry? Need to determine if this was a false positive and decipher the log entry if possible.  Was this a PC, or mobile device?

Why not create a traffic drop rule to that IP/DNS?

Doesn't the UTM9 automatically create such rules? 

I've never known UTM to automatically block outgoing traffic.  By default, it is setup to block traffic not designated outside the allowed ruleset, but if your botnet is outgoing over standard port traffic such as port 80, no.  Some people who are completely ignorant to firewalls just tell 'Any' traffic to pass through, build other rules below the 'Any' ruleset and can't figure out why it doesn't work.

Your log would tell us where it's going, and you can setup a blackhole, so anything sent to that IP would just get 'lost'.

Good advice, a drop rule to that IP is active. I'm going to have a look at the logs and see what I can find.

Any idea on how to remove the botnet? It hasnt been detected / removed by sophos, malwarebytes or defender. 

It could be just a false positive that's being picked up because it has some similar properties in the packets.  If you can copy/paste some of the logs so we can see what it's doing, where it's going.  Feel free to obfuscate any IP address information if you wish.

It could be just a false positive that's being picked up because it has some similar properties in the packets.  If you can copy/paste some of the logs so we can see what it's doing, where it's going.  Feel free to obfuscate any IP address information if you wish.