Possible False Positive

[Robnyc34]

Hello All,

When trying to launch Half-Life 2: The Lost Coast from my Steam application, Malwarebytes flags the exe file as well as some of the additional files as Malware, specifically labeling it as a Malware.Packer.RRE, it quarantines the file and prevents the game from launching.

At first I was concerned, thinking that the game file had somehow really been infected, so I quarantined and deleted everything that was flagged, restarted the computer, did a full scan and my PC registered as being clean and free of any Malware.

I then re-downloaded a clean copy of The Lost Coast from Steam, and again, it was flagged as Malware and prevents me from launching.

Is anyone else having problems with launching Steam games and where they get flagged as Malware, specifically The Lost Coast?

[Atribune]

Before reporting a false positive, you need to save a log in developer mode. This will allow us to figure out how the false positive came to be. Simply follow these directions.

1. Click the Start Menu.

2. Click Run.

3. Type in "mbam.exe /developer", without the quotes.

4. Run the same type of scan you did before and save the logfile and post it.

Additionally, please attach the file with your post. Make sure it is in ZIP or RAR format.

Note: The above need not be done for IP false\positives.

[Fatdcuk]

Hi Robnyc34,

Please can zip and attach some of the files that we are detecting as Malware.Packer.RRE.

[bspmail]

I ran a scan overnight and half-life 2 (hl2.exe) also showed for me as Malware.Packer.RRE after the scan was complete.

[Robnyc34]

Hi Robnyc34,

Please can zip and attach some of the files that we are detecting as Malware.Packer.RRE.

Apologies, but how do I attach a file on this forum, there is no attach file button that I see in the reply window, and when I click on "My Media" there doesn't seem to be a way to attach a file.

[Fatdcuk]

Apologies, but how do I attach a file on this forum, there is no attach file button that I see in the reply window, and when I click on "My Media" there doesn't seem to be a way to attach a file.

Next to where its says post is a button called more reply options.

If you click on this it will open up a more detailed reply menu.

At the bottom of that window is an option to browse\attach files.

You will need to either zip or rar (compress) the file(s) before attaching the compressed archive.

[Robnyc34]

Thank you.

Here is an attachment of the zipped file as well as a copy and paste of the log from Malwarebytes:

Malwarebytes Anti-Malware (PRO) 1.75.0.1300

www.malwarebytes.org

Database version: v2013.06.05.02

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Robert :: ROBERT-8B62122B [administrator]

Protection: Enabled

6/5/2013 1:03:00 PM

MBAM-log-2013-06-05 (13-54-29).txt

Scan type: Full scan (C:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 293563

Time elapsed: 35 minute(s), 6 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Program Files\Steam\steamapps\robbassinyoface\half-life 2 lostcoast\hl2.exe (Malware.Packer.RRE) -> No action taken. [55414de5511b0234088d90a3d52cb34d]

(end)

hl2.zip

[Robnyc34]

I ran a scan overnight and half-life 2 (hl2.exe) also showed for me as Malware.Packer.RRE after the scan was complete.

So it's not just the Lost Coast, it's all Half-Life 2 game files? Will this also effect other Steam games?

[Fatdcuk]

Ok i can confirm this is a F/p detection and will be fixed on the next update cycle.

Thanks for your assistance on getting this fixed.

[Robnyc34]

Ok i can confirm this is a F/p detection and will be fixed on the next update cycle.

Thanks for your assistance on getting this fixed.

Thank you.