Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 10

After installing HF2, Microsoft Safety Scanner detects Solarigate?

Jump to solution

Coming from 2020.2.1, I installed HF1 early morning Monday. I then downloaded and ran the Microsoft Safety Scanner and my systems came back clean. I also ran Yara with the FireEye signatures. This also came back clean.

Yesterday evening, after installing HF2, I redownloaded and reran the Microsoft Safety Scanner just to be on the safe side. This morning, I logged in and saw that it has detected Solarigate.  I checked the hash of the binary  and it was the clean version. I've now shut down our systems.

Before I rebuild and possibly reinstall the same file and get the same detection, has anyone else seen this? Is it possible this is a false positive?




0 Kudos
1 Solution
3 Replies
Product Manager
Product Manager

Can you post the Windows Safety Scanner Log file located under 'C:\Windows\Debug\msert.log'?

0 Kudos

That's interesting, but when I downloaded and ran the Safety Scanner Monday morning, it didn't detect anything. It was only after I updated to HF2 AND re-downloaded the latest Safety Scanner that it was detected. I'm guessing MS added signatures.




0 Kudos