Trojan:Win32/Cerdigent.A!dha

Question

Trojan:Win32/Cerdigent.A!dha

Daniel Sandlund 115

Getting a Trojan warning Trojan:Win32/Cerdigent.A!dha

Looks like there are many getting this right now...

Is it a false possitive?

Yurii Stoliar 15 Reputation points

2026-05-03T11:50:47.42+00:00

We've encountered the same issue, but there's no additional information about the source of the problem
Ralf Hartwig 0 Reputation points

2026-05-03T12:12:58.47+00:00

WAs ist drann... auf 2 Geräten. Geht nicht sauber raus . Was tun?
What's the deal? It's happening on two devices. It won't come out cleanly. What should I do?
Michael Chen 10 Reputation points

2026-05-03T13:06:43.16+00:00

Same issue here after updating the Microsoft system this morning. I've tried to delete it or use the offline malware detector but neither of them works.
Andy Chambers 10 Reputation points

2026-05-03T13:12:22.0233333+00:00

Seeing this issue as well. Seems to correlate with the latest Update for defender/ATP. (UK) Reddit forums are very active in relation to this as well, suggesting that this is a global issue. Appears to be a false positive.

Trojan:Win32/Cerdigent.A!dha

rootcert: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

rootcert: DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

Update: KB2267602 ---> Resolved.
Med Kacem Bouchmila 20 Reputation points

2026-05-03T13:55:36.7433333+00:00

I got the same problem here ! Is it a false positive or what ?
Colossus SC 0 Reputation points

2026-05-03T14:10:36.5866667+00:00

Should I place it in the quarantine area or move it out? If it is deleted, I'm afraid it might cause some impact on the system.
Milica Nikolic 5 Reputation points

2026-05-03T14:17:26.52+00:00

Today I was doing something on my phone at one point around 3pm. I heard a defender. Worst of all, the same thing appeared next to my computer and my parents' computer. I don't know what it is, but I hope it's the latest update, but I hope in a few hours I'll find out what went wrong and where this chaos came from.
Jasper swain 0 Reputation points

2026-05-03T17:42:47.8933333+00:00

I’ve had this problem too, It’s my first notification of a virus in 5 years of using my PC, done multiple full annd quick scans that show the threat and multiple offline scans that haven’t shown anything. And deleted the potential virus, but it keeps being picked up by the quick scan after restarting my PC or doing an offline scan. I was only able to find this thread after googling what ‘rootcert: numbers/letters’ meant.

EDIT: updated the newest windows security fix in ‘windows updates’ , and no longer getting the alert from windows defender quick scan even after restarting my PC. So hopefully it is a false positive.
wendell sam vicente 0 Reputation points

2026-05-03T18:01:56.9066667+00:00

Yeah just now i panic and did a full Microsoft offline anti-virus
davey sans 0 Reputation points

2026-05-03T18:42:02.7933333+00:00

Bro all of these threats are the cerdigent.a!dha this has to be a false postive right??? it always says "no threats found" then the next scan "1 threat found"
Jason Smith 5 Reputation points

2026-05-03T18:52:25.8866667+00:00

Yeah, looks like a false positive. I deleted it and started a full scan just to be safe. Seeing so many people get the exact same alert at the same time was a huge sigh of relief.
Mehrad Moradipour 0 Reputation points

2026-05-04T08:28:00.6966667+00:00

Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha
https://www.bleepingcomputer.com/news/security/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha/

5 answers

Your answer

Yurii Stoliar 15 Reputation points

2026-05-03T11:50:47.42+00:00

We've encountered the same issue, but there's no additional information about the source of the problem
Ralf Hartwig 0 Reputation points

2026-05-03T12:12:58.47+00:00

WAs ist drann... auf 2 Geräten. Geht nicht sauber raus . Was tun?
What's the deal? It's happening on two devices. It won't come out cleanly. What should I do?
Michael Chen 10 Reputation points

2026-05-03T13:06:43.16+00:00

Same issue here after updating the Microsoft system this morning. I've tried to delete it or use the offline malware detector but neither of them works.
Andy Chambers 10 Reputation points

2026-05-03T13:12:22.0233333+00:00

Seeing this issue as well. Seems to correlate with the latest Update for defender/ATP. (UK) Reddit forums are very active in relation to this as well, suggesting that this is a global issue. Appears to be a false positive.

Trojan:Win32/Cerdigent.A!dha

rootcert: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

rootcert: DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

Update: KB2267602 ---> Resolved.
Med Kacem Bouchmila 20 Reputation points

2026-05-03T13:55:36.7433333+00:00

I got the same problem here ! Is it a false positive or what ?
Colossus SC 0 Reputation points

2026-05-03T14:10:36.5866667+00:00

Should I place it in the quarantine area or move it out? If it is deleted, I'm afraid it might cause some impact on the system.
Milica Nikolic 5 Reputation points

2026-05-03T14:17:26.52+00:00

Today I was doing something on my phone at one point around 3pm. I heard a defender. Worst of all, the same thing appeared next to my computer and my parents' computer. I don't know what it is, but I hope it's the latest update, but I hope in a few hours I'll find out what went wrong and where this chaos came from.
Jasper swain 0 Reputation points

2026-05-03T17:42:47.8933333+00:00

I’ve had this problem too, It’s my first notification of a virus in 5 years of using my PC, done multiple full annd quick scans that show the threat and multiple offline scans that haven’t shown anything. And deleted the potential virus, but it keeps being picked up by the quick scan after restarting my PC or doing an offline scan. I was only able to find this thread after googling what ‘rootcert: numbers/letters’ meant.

EDIT: updated the newest windows security fix in ‘windows updates’ , and no longer getting the alert from windows defender quick scan even after restarting my PC. So hopefully it is a false positive.
wendell sam vicente 0 Reputation points

2026-05-03T18:01:56.9066667+00:00

Yeah just now i panic and did a full Microsoft offline anti-virus
davey sans 0 Reputation points

2026-05-03T18:42:02.7933333+00:00

Bro all of these threats are the cerdigent.a!dha this has to be a false postive right??? it always says "no threats found" then the next scan "1 threat found"
Jason Smith 5 Reputation points

2026-05-03T18:52:25.8866667+00:00

Yeah, looks like a false positive. I deleted it and started a full scan just to be safe. Seeing so many people get the exact same alert at the same time was a huge sigh of relief.
Mehrad Moradipour 0 Reputation points

2026-05-04T08:28:00.6966667+00:00

Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha
https://www.bleepingcomputer.com/news/security/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha/

Answer 1

_AW_ 67,251 Volunteer Moderator

Run Windows Update. This is resolved in the latest Microsoft Security definition update 1.449.430.0 and no longer detected.

Hiroyuki Diva 5 Reputation points

2026-05-03T15:22:00.77+00:00

i also got the same problem! i was so panicked cause i used to got trojan, i ran a quick scan and removed but somehow it doesn't worked, i ran a full scan, it also doesn't work, i ran an offline scan and it STILL there! i scanned it using MalwareBytes but got nothing, only in Microsoft Defender. i thought malwarebytes can't scanned it, so i go RESET my windows. if only i seen this earlier...
Andy Chambers 10 Reputation points

2026-05-03T17:52:19.9933333+00:00

Confirmed - Thanks.
Rui Soares 0 Reputation points

2026-05-03T19:41:00.5+00:00

In The last 8 hours I've detected several times the same "Trojan:Win32/Cerdigent.A!dha" and, after its remotion, it was detected again, over and over.

I hope it's realy a false positive.

After running windows update 15 minutes ago (Microsoft Defender Antivirus - 2267602 KB version 1.449.432.0), it's not hapening any more. Let's see in the future.

Thank you for your feedback!
sriii 0 Reputation points

2026-05-03T22:23:46.52+00:00

For those who quarantined these certs like I did, are you restoring them? Any thoughts on what happens if I leave them in quarantine? Thanks!
sonoMrTonno 0 Reputation points

2026-05-04T08:24:16.53+00:00

I've noticed this Trojan since this morning, too. I'm really scared by this.

Answer 2

George Birbilis 0

They're removing some root certificates that are being exploited:

https://bugzilla.mozilla.org/show_bug.cgi?id=2033170

0 comments

Answer 3

Andy Barker 0

I am seeing this alert from Microsoft but not from SentinelOne or Arctic Wolf. Usually, in legitimate cases, all three are alerting me. I believe this could be a false positive.

Mark Locascio 0 Reputation points

2026-05-03T14:44:34.28+00:00

Microsoft defender found the same thing on my computer. I never got a notification that it was on my computer until I turned it on this morning.

I used Defender to quarantine it and then delete it. It seems to have worked as I got a threat removed notice.
Milica Nikolic 5 Reputation points

2026-05-03T15:16:11.9766667+00:00

After a little more than two hours of research, I came to the conclusion that it is time to update the defender.
Milica Nikolic 5 Reputation points

2026-05-03T15:19:41.3066667+00:00

If you are wondering how I took another laptop that got an update when the update finished, I took Defender and found that problem. So my conclusion is up to the last Defender update.

Answer 4

Trojan:Win32/Cerdigent.A!dha is detected as a trojan by Microsoft Defender. The context does not state that this specific detection is a known false positive.

To handle a potential false positive in Microsoft Defender products, the supported process is:

Determine the detection source (for example, Microsoft Defender Antivirus vs. EDR in Defender for Endpoint).
If the file or process is believed to be clean, submit it to Microsoft for analysis as a suspected false positive at the Microsoft malware submission portal (https://aka.ms/wdsi).
As a temporary workaround while waiting for analysis, an administrator can add an appropriate exclusion or an allow indicator for the specific file hash, if this is acceptable in the security policy.

If the file is not known and not explicitly trusted, it should be treated as malicious and removed or quarantined by Defender.

References:

Answer 5

Mehrad Moradipour 0

Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha https://www.bleepingcomputer.com/news/security/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha/

0 comments

Share via

Trojan:Win32/Cerdigent.A!dha

5 answers

Your answer