meraki flagging webroot installer file as malware (wsasme.exe)
Just saw alerts pop up reporting a malicious file was downloaded (wsasme.exe). It looks to be an automatic update for the Webroot av. virus scans on those machines reported no issues and they aren't acting strange. This appeared to be a false positive - anyone else experiencing this?
If it helps anyone, I just hashed the file, (locally on a Windows 11 VM), and it came back with the same hash as virustotal. I then downloaded on a separate machine, hashed that file and that hash also matched.
Ticket I had open with Meraki, response this morning:
Thanks for your response. Yes, I can confirm that you can trust Webroot and wsasme.exe is not a malicious file. Please ignore the alert, and I will close the ticket at this time.
Kunal Konduru Cisco Meraki Technical Support
Webroot Support response yesterday:
The reason that Joe Sandbox lists for their "Suspicious" file determination (hooking functions) is normal for an Antivirus program. Cisco appears to be marking wsasme.exe as a threat for the same reason, however only Cisco support would be able to confirm this. If you have any further questions about this false positive, we recommend reaching out to Cisco support.
The Webroot Advanced Malware Removal Team
This is a legitimate Webroot file. Please reach out to Cisco support for further assistance with this false positive.