Malware.AI.1301800893 - Picked up SolarWinds Antivirus Asset Scan

[AlexLeadingEdge]

I believe this is a false positive as it is part of our SolarWinds Antivirus package (BitDefender and LanGuard). VirusTotal says there are no hits. File is attached, the password is 'infected'.

https://www.virustotal.com/gui/file/69e4de45eb900381c0bb085497393f3b0ea35607f46f77436f17a23ff1b82471/detection

 

Malware.AI.1301800893
Malware
File
C:\PROGRAM FILES (X86)\ADVANCED MONITORING AGENT\ASSETSCAN.EXE

assetscan.zip

[cli]

Thanks for reporting, this will be fixed in 10 minutes.

[AlexLeadingEdge]

Hi Cli,

This detection has come back, same detection name: Malware.AI.1301800893

 

We even Whitelisted the whole folder it was in, so I don't know why it could have Quarantined it:

Edited May 18, 2021 by AlexLeadingEdge

[cli]

Can you attach logs? I scanned the file on my computer and did not see a detection. So it is very likely that there was a networking error during the whitelist check.

[AlexLeadingEdge]

Cheers Cli, I have PM'd you the logs.

I see the machine is on our repair bench, which probably means Malwarebytes was re-installed sometime in the last four day, but I see no emails notifying me of a new install so I can't be certain.

[cli]

Thanks for the logs, I can confirm that there was a networking issue during the whitelist check so it ended up getting detected. The file is still whitelisted though so as long as there are no other networking error, the file should not be detected.

[AlexLeadingEdge]

Same problem again today. The bottom one is whitelisted ("Exclusions") and yet it has been quarantined.

The other one is RdpGuard, a security program we use to block IPs after several failed RDP attempts.

 

Malware.AI.2838036267	Reg, Key	Malware	Quarantined	HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\RdpGuard_is1
Malware.AI.2838036267	File	Malware	Quarantined	C:\PROGRAM FILES (X86)\RDPGUARD\UNINS000.EXE
Malware.AI.2838036267	Reg, Key	Malware	Quarantined	HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F88FE7C0-2B64-405B-9197-25F8BE135460}_is1
Malware.AI.2838036267	File	Malware	Quarantined	C:\PROGRAM FILES\ADVANCED MONITORING AGENT NETWORK MANAGEMENT\UNINS000.EXE

 

Two are Registry entries, attached are the two uninstallers.

unins000_SolarWinds_Advanced_Monitoring_Agent.zip unins000_RdpGuard.zip

[shadowwar]

These files are currently whitelisted in the cloud. 

 

[AlexLeadingEdge]

Ok. I don't know what to say to that. Perhaps someone else reported it over the weekend?

[Porthos]

The computer is having networking issues of some kind that is not allowing MB cloud access. Even if you can access the rest of the web.