Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

[hhiggins]

Hi,

Since yesterday April 13/2020 I have been getting Virus alerts in the Threat log on my PAN 3020. It has pointed out that OneDriveSetup.exe is the culprit.

I went to a few machines and searched for OneDriveSetup.exe and uploaded it to VirusTotal. All came back clean. I then ran a malware scan (Cortex) on a few machines and again it came back clean. I waited until today to see if the new AV signatures were adjusted, but they were not as I am still getting alerts today.

Has anyone else received these? From what I am seeing it is looking like a false positive.

Thanks

[hisingh]

Hello @hhiggins 

Thank you for bringing this to our attention. We have noticed a few other similar issues. I am glad it is been resolved. Please let me know if I can answer any more questions.

Best 

[AaronBeck]

Good morning @hisingh 

We are still seeing these alerts. How did you resolve the problem?

Thanks!

-Aaron

[hhiggins]

@hisingh ,

This is NOT resolved. This is STILL a problem.

[abrickeen]

This appears to be a false positive kicked off by the latest sync app update.

https://docs.microsoft.com/en-us/onedrive/sync-client-update-process

[hhiggins]

@abrickeen I would agree it is likely a false positive. We need PAN to adjust their content signatures.

For me, this started with the Antivirus 3316-3827 content version.

[hisingh]

Hello @hhiggins 

Can you share the hash please, I will check the current status.

Best

[hisingh]

Hello @hhiggins, @abrickeen, and @AaronBeck 

Thank you for waiting for my response. If you all are seeing the TID: 341427639, this signature is been disabled today, which means Wildfire signature is disabled immediately, and the AV signature will be disabled tomorrow if nothing goes wrong.  You can safely put in a threat exception for Threat ID: 341427639 to get traffic moving again.

If your threat ID is different then 341427639, share it with me.

Best regards,

Himani

[hhiggins]

Thanks @hisingh . I will check tomorrow to see if this behavior stops. Does this mean there was an issue identified with the Antivirus content?

[hhiggins]

@hisingh I still see the EXE being flagged as a virus. Today, with the new content updates, the virus is being flagged differently. 

Virus/Win32.WGeneric.ajepxx

ID 341677293

@AaronBeck @abrickeen are you seeing this as well?

[AaronBeck]

@hhiggins 

It looks like it stopped around 5:10:41 AM PST 4/15/2020.

[hisingh · Accepted solution]

Hello @hhiggins 

I am glad the signature 341427639, is been disabled. 

This new signature, Virus/Win32.WGeneric.ajepxx, has a very high VT detection https://www.virustotal.com/gui/file/002a33f2f0d47c03a80539b71f3a312d146fa8c671ce8627254cfa0dd55d3407...

Are you sure it is detected in OneDriveSetup.exe

Best 

Himani

[hhiggins]

@hisingh I have had no alerts for 24 hours now. I would consider this resolved at this point.

Thanks

[AaronBeck]

This has recently started occurring again and is filling up my SIEM. Please help @hisingh !

[hisingh]

Hello @AaronBeck 

Thanks for sharing with me. 
This signature is disabled since April 2020. How are you seeing it?

https://threatvault.paloaltonetworks.com/?query=Win32.WGeneric.ajdriy&type=

Best

Himani