Gen.Variant.Fugrafa.aa9618c8

SLMark1

We have seen a major increase in security alerts related to Gen.Variant.Fugrafa.aa9618c8. All seem to be USG Flex 200 devices via SecuReporter. Is this a false positive? The alerts all seem to have started around the same time from unrelated clients?

KTAnthony

We are seeing the same thing. If we could please get an update on how to resolve this. Thanks.

SLMark1

Does it seem to be triggered by Visual C++ Runtime?

KTAnthony

Virus Name: Gen.Variant.Fugrafa.aa9618c8
File Name: Microsoft.VCLibs.140.00_14.0.30704.0_x86__8wekyb3d8bbwe.Appx

I have been seeing it come from other file names throughout our networks, but this is the most common one. @SLMArk1 I believe it is a corrupted Microsoft Visual C++ Runtime update from what I have read online.

Vojta

I have the same problem on the ATP500. Is this a false alarm?

ticsystems

I have the same problem in 2 different clients with ATP500 and ATP700

ECOL

same issue on ATP800. CDR is configured to block clients with detected malware so it is currently blocking lot of clients. please fix it soon

MichalSK

So far, I have registered this on two ATP facilities

Winfo

Same problem here

ticsystems

Another client with atp 200 

Zyxel_Stanley

We have noticed it and it should be false positive.
Please update signature manually few hours later, the symptom will gone.