About Matthew_Hayes

Matthew_Hayes · ‎01-23-2023

Thanks @ymiyashita, After checking that last link you posted it explains why a lot of the information within the logs is missing and why it would be picked up as a virus within the firewall. There were no wildfire submissions related to the threat logs either so I suspect that a false positive is the case Thanks again, Matt

Matthew_Hayes · ‎01-23-2023

Thanks for replying! The issue we are facing is that in the Logs we are seeing it does not supply a file Hash or any other indication to which files are actively causing these alerts to occur, It only shows the application as MS-DS-SMBv3 which does not really sound correct. I will look into the AV collision to check if this is applicable. Thanks, Matt.

Matthew_Hayes · ‎01-23-2023

We are receiving a large quantity of logs affecting a limited number of users for this threat IDName: Trojan-Downloader/Win32.guloader.ao Unique Threat ID: 479496371 Create Time: 2022-04-05 09:11:48 (UTC) Threat ID: 2837943 Current Release: 4338 (2023-01-23 UTC) First Release: 4044 (2022-04-05 UTC) We suspect that this is a false positive, Is anyone experiencing the same Issue or have any ideas on weather this can be resolved? Thanks.

Member Since	‎01-23-2023 04:35 PM
Date Last Visited	‎01-23-2023 08:30 PM
Posts	3

Online Status	Offline
Date Last Visited	‎01-23-2023 08:30 PM

About Matthew_Hayes

Re: ms-ds-smbv3 - Trojan-Downloader/Win32.guloader.ao

Re: ms-ds-smbv3 - Trojan-Downloader/Win32.guloader.ao

ms-ds-smbv3 - Trojan-Downloader/Win32.guloader.ao

Re: ms-ds-smbv3 - Trojan-Downloader/Win32.guloader.ao

Re: ms-ds-smbv3 - Trojan-Downloader/Win32.guloader.ao

ms-ds-smbv3 - Trojan-Downloader/Win32.guloader.ao