This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

false positive - dasHost.exe identified as ransomware

The md5 hash of this file, 66CFAA5940A06DAF10F5203BC2B1A5AB, is detected on 65+ Windows 8.1 hosts on our network. The Device Association Framework Provider Host is a legitimate part of Windows 8 & does not exhibit any odd behavior when executed inside a sandbox. This is the alert received in the cloud console:

High alert received from Sophos Central: CryptoGuard detected ransomware in C:\Windows\System32\dasHost.exe

I have opened a support case regarding this issue a couple of days ago but have not yet received a satisfactory answer.

-Gary

This thread was automatically locked due to age.

Aditya Patel over 8 years ago

Hi Gary ,

Could you share your Service request number via private message . I would like to look into the issue and also add the link to this thread for reference.

Thanks and Regards

Aditya Patel

Regards,

Aditya Patel
Global Escalation Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
MarekDalke over 8 years ago

Same problem observed here on two Windows 10 Pro hosts.
Cancel
Vote Up 0 Vote Down

Cancel
shane kelm over 8 years ago

We have this same issue. Both workstations are Windows 10 post 1607

Alert from Sophos Central

CryptoGuard detected ransomware in C:\Windows\System32\dasHost.exe

Shane
Cancel
Vote Up 0 Vote Down

Cancel
Aditya Patel over 8 years ago in reply to shane kelm

HI All,

We have few cases for the same and Found that this issue will be addressed shortly and with the BUG ID WINEP-6349 , I would advise anyone who is facing this issue to log a case in Support to add and record such instances .

Thanks and Regards

Aditya Patel | Network and Security engineer

Regards,

Aditya Patel
Global Escalation Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
JamiePassalacqua over 8 years ago

same here, opened a ticket. also the link to get support on the Sopho Central site brings me to a "Page Not Found"....
Cancel
Vote Up 0 Vote Down

Cancel
gdriggs over 8 years ago in reply to JamiePassalacqua

We are now seeing these on Windows 8.1 endpoints as well.
Cancel
Vote Up 0 Vote Down

Cancel
Aditya Patel over 8 years ago in reply to gdriggs

HI gdriggs,

This will be resolved in the next release .

No ETA of the release date.

Thanks

Aditya Patel

Regards,

Aditya Patel
Global Escalation Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
David Coombe over 7 years ago in reply to Aditya Patel

I just got one today on a Windows 10 box.
Cancel
Vote Up 0 Vote Down

Cancel
Gabor over 7 years ago

We've got a false positive as well today on Windows 10 x64 1607 LTS.

Sophos AV version: 10.7.2.v£3.68.0
Detection Data: 5.40

Exploit prevention agent version: 3.6.3.583

-Gabor-
Cancel
Vote Up 0 Vote Down

Cancel
Jayden Ashworth over 5 years ago in reply to Aditya Patel

2 and a half years later - has that fix came out yet? This issue is still occurring.
Cancel
Vote Up 0 Vote Down

Cancel