Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

[hhiggins]

Hi,

Since yesterday April 13/2020 I have been getting Virus alerts in the Threat log on my PAN 3020. It has pointed out that OneDriveSetup.exe is the culprit.

I went to a few machines and searched for OneDriveSetup.exe and uploaded it to VirusTotal. All came back clean. I then ran a malware scan (Cortex) on a few machines and again it came back clean. I waited until today to see if the new AV signatures were adjusted, but they were not as I am still getting alerts today.

Has anyone else received these? From what I am seeing it is looking like a false positive.

Thanks

[AaronBeck]

Ah, it appears to be a different name now but is triggering on the same file.

oneclient.sfx.ms/Win/Prod/20.084.0426.0007/OneDriveSetup.exe

Virus/Win32.WGeneric.aktxlj

348874710 

https://threatvault.paloaltonetworks.com/?query=348874710

[AaronBeck]

It actually looks like there are multiple:

@hisingh 

Virus/Win32.WGeneric.aktxlj

Virus/Win32.WGeneric.aktpum

[hisingh]

Hi

I have asked the team to check Virus/Win32.WGeneric.aktxlj, I will update.

Win32.WGeneric.aktpum is disabled already. 

Best

Himani

[AaronBeck]

Win32.WGeneric.aktpum Stopped at 7:10 this morning, was this just turned off? @hisingh 

[hisingh]

Hi

Virus/Win32.WGeneric.aktxlj is a malware

Win32.WGeneric.aktpum was disabled on 06-28-2020. 

Best

Himani

[AaronBeck]

Ah, well it looks like from 7:10 - 7:11 it was triggering on the same OneDriveSetup.exe but that has stopped as well. Thanks!

[hhiggins]

Arg! @hisingh ....Same problem again @AaronBeck . Virus/Win32.WGeneric.aktpum has been setting off alarm bells.