Maybe Microsoft is trying to hunt down a piece of malware that has an authentic digital signature? Stuxnet had it.