DeepGuard blocks windows defender (msmpeng.exe)
we currently have Client Security 13.11 build 110 installed on various Win10 machines.
Nearly daily we get 1 - 5 Notifications about DeepGuard Security alerts regarding blocked msmpeng.exe.
Product: F-Secure DeepGuard (OID: 22.214.171.124.4.1.2213.53)
Severity: security alert (5)
Message: Action by malware was blocked.
Malware path: c:\programdata\microsoft\windows defender\platform\4.18.1807.18075-0\msmpeng.exe
File hash: 82e7ffb4e780bf16f3c42d52e2c6b0a4ef48732c
I have tried to exclude the filehash a few times on the PM, without success, also hash changes a lot, so thats not really a solution.
Vad Posts: 1,089 Forum Guru
In version 13.11 we'd introduced a new exclusions policy setting for DeepGuard: "Excluded applications" (Object identifier 126.96.36.199.4.1.2188.8.131.52). This policy provides a possibility to exclude applications by name/path. Please, try it.
i had already added "msmpeng.exe" alone in this section, but as it states it needs full paths -> didn't work that way.
i will try it with the full paths of reported msmpeng.exe now (fortunately there are only 2 different paths at the moment where msmpeng.exe lives). Will report if any notifications get send again. Thank you for now!
excluded apps now:
c:\programdata\microsoft\windows defender\platform\4.12.17007.18022-0\msmpeng.exe0 Like