Antivirus Still Detecting Affected SolarWinds.Orion.Core.BusinessLayer.dll after Upgrade

You have applied the latest version according to the SolarWinds Security Advisory, but antivirus software continues to flag the SolarWinds.Orion.Core.BusinessLayer.dll as being present on your Orion Server.

Depending on the number of steps taken to upgrade to the latest Orion Platform version, the affected SolarWinds.Orion.Core.BusinessLayer.dll was removed and replaced from the runtime area, prohibiting it from executing further. However, MSIs (Microsoft installer packages) containing the old version of the file were not fully removed.

To address this issue, follow the instructions described here: Check your environment for the Sunburst vulnerability using the new PowerShell script .

If antivirus software continues to flag DLLs or MSIs as being present, you might need to manually delete/remove the MSIs identified by your antivirus software from your Installers directory. By default, the Installers directory is in the following location:

C:\ProgramData\Solarwinds\Installers

Depending on your upgrade path, you might need to remove the following MSIs.

If you upgraded from 2019.4 HF5 to 2021.2.1 HF2, the following files can be safely removed:

• CORE-2019.4.5220.20161-CoreInstaller.msi
• NCM-2019.4.0.3834-NcmInstaller.msi
• CORE-2019.4.5220.20574-SolarWinds-Core-v2019.4.5220-Hotfix5.msp
• TOOLSETWEB-2019.4.0.31-ToolsetInstaller.msi

If you upgraded from 2020.2 to 2020.2.1 HF2, the following files can be safely removed:

• CORE-2020.2.5320.27438-CoreInstaller.msi
• NCM-2020.2.0.6162-NcmInstaller.msi