Skip to main content
Solved

Win.Trojan.Coffeeloader


I am seeing an number of hits from different client of the Win.Trojan.Coffeeloader malware of the last couple of days.  Has anyone else seen this one.  I have done reading on this but doesn’t seem to be any real data on how to  properly check that these hits are legit and not false postives.  They seem to find the issue in ARMOURYAIOSDK.DLL from Asus Armoury Crate.  I have check the first system with additional malware checkers and found nothing.  Webroot has been quarantining the file but trying to get a second opinion from other checkers.  Anyone else seeing this?

Best answer by TripleHelix

Hello ​@BdubIT 

 

Please contact Webroot Support Directly and they will sort it out for you! Can you tell me if your a Consumer or a Business user?

 

Business Users: https://www.webroot.com/us/en/business/support/contact

 

Consumer Users at the Bottom of the page: https://www.webroot.com/us/en/support/support-home

 

Thanks,

View original
Did this help you find an answer to your question?

TripleHelix
Moderator
Forum|alt.badge.img+63

Hello ​@BdubIT 

 

Please contact Webroot Support Directly and they will sort it out for you! Can you tell me if your a Consumer or a Business user?

 

Business Users: https://www.webroot.com/us/en/business/support/contact

 

Consumer Users at the Bottom of the page: https://www.webroot.com/us/en/support/support-home

 

Thanks,


  • Fresh Face
  • March 28, 2025

    MSP using webroot endpoint.  I will open a ticket on business users page.


TripleHelix
Moderator
Forum|alt.badge.img+63
BdubIT wrote:

    MSP using webroot endpoint.  I will open a ticket on business users page.

Thanks and please use the Business links and support ticket is best.


TripleHelix
Moderator
Forum|alt.badge.img+63

  • Fresh Face
  • March 28, 2025

Just got off the phone with Webroot support the MD5 for both locations is being updated as false positive thankfully.  I had already read an alert on this malware yesterday and was concerned based on the data.  Thankfully for us the detections are at this stage false positives.  Thanks for passing all that info on ​@TripleHelix.


TripleHelix
Moderator
Forum|alt.badge.img+63
BdubIT wrote:

Just got off the phone with Webroot support the MD5 for both locations is being updated as false positive thankfully.  I had already read an alert on this malware yesterday and was concerned based on the data.  Thankfully for us the detections are at this stage false positives.  Thanks for passing all that info on ​@TripleHelix.

Great to hear! 👍🏻


Reply