Windows Defender removes Dell’s private key root certificates

Microsoft has added eDellRoot and DSDTestProvider to its antimalware definitions and Windows Defender detects and blocks or removes both certificates as a result. Defender considers the certificates a ‘possible threat’.

Microsoft has named the antimalware definitions for eDellRoot and DSDTestProvider Win32/CompromisedCert.C and Win32/CompromisedCert.D. Microsoft’s security software has given the certificates a ‘medium’ warning level. The update was released during the night from Wednesday to Thursday and Dell PC buyers can now use Microsoft’s anti-malware software to remove or block private key certificates from their systems.

The update will be released within a few days of the discovery of the DSDTestProvider certificate and a few days of eDellRoot being released. Dell previously published a guide to manually uninstall eDellRoot. The root certificates with private keys allow abuse, for example by signing malware with them so that Windows accepts them as an authentic Windows program. In addition, there are man-in-the-middle attacks, where the Dell systems make https connections via fake domains without raising the alarm. It is unknown if other malware scanners will also add the root certificates to their definitions.