Fsamsi64.dll

0 views

Skip to first unread message

Amit Bolds

unread,

Aug 5, 2024, 6:53:41 AM8/5/24

to adinulol

Ihave a problem with many 5038 events on our clients. The problem seems to come from the fsamsi64.dll which is reported as corrupted by Defender. It seems to be related to the digital signature of the file, which is not from Microsoft but from F-Secure.

Antimalware Scan Interface (AMSI) is an API that allows applications to request antimalware products installed on the computer to scan their data for harmful content, provided that such antimalware products have exposed their scanning services via AMSI.

However, Defender itself has a security measure that prevents any DLLs which are not signed by Microsoft from being loaded into its processes. This means that in case a non-Microsoft AMSI provider is registered to the system, Defender will try to load it, but will reject it because it does not have a Microsoft signature, and an error will be written to the event log.