meraki flagging webroot installer file as malware (wsasme.exe)

New here

meraki flagging webroot installer file as malware (wsasme.exe)

Just saw alerts pop up reporting a malicious file was downloaded (wsasme.exe). It looks to be an automatic update for the Webroot av. virus scans on those machines reported no issues and they aren't acting strange. This appeared to be a false positive - anyone else experiencing this?

Getting noticed

We're seeing the same thing on multiple networks, I started a case with Meraki support and also started a post.  I am not sure if there is a way to Merge them.

New here

We are having the same issues.  Looks to be a good hash but I'm waiting to take action till I get more info.


New here

We're seeing the same.

Here to help

If it helps anyone, I just hashed the file, (locally on a Windows 11 VM), and it came back with the same hash as virustotal.  I then downloaded on a separate machine, hashed that file and that hash also matched.

Do you mean the hash came back as expected and you don't consider it a threat? 

In my case, NO I do not consider it a threat, as we are running webroot and I also verified with our RMM provider (whom we get the license from) has been pushing out updates this week.

Getting noticed

We had same alert on our MX firewalls


Disposition - Malicious | Type - MS_EXE | Size - 5657272 bytes


Ticket I had open with Meraki, response this morning:


Thanks for your response. Yes, I can confirm that you can trust Webroot and wsasme.exe is not a malicious file. Please ignore the alert, and I will close the ticket at this time.

Thank you,

Kunal Konduru
Cisco Meraki Technical Support


Webroot Support response yesterday:


The reason that Joe Sandbox lists for their "Suspicious" file determination (hooking functions) is normal for an Antivirus program. Cisco appears to be marking wsasme.exe as a threat for the same reason, however only Cisco support would be able to confirm this. If you have any further questions about this false positive, we recommend reaching out to Cisco support.



The Webroot Advanced Malware Removal Team



This is a legitimate Webroot file. Please reach out to Cisco support for further assistance with this false positive.



The Webroot Advanced Malware Removal Team

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.