Compiled Visual Basic 6 Program False Positive

[rwan1]

Recently discovered that Malwarebytes will quarantine any program written in VisualBasic 6 with a "MachineLearning/Anomalous" alert.  This includes the most innocuous programs.

It runs OK within the VB6 programming structure, but MB rejects any .EXE file compiled from VisualBasic.

I've attached a ZIP file with an example.  The program contains a single button, which does nothing but change the color of a block from gray to black.

 

rwan1.zip

[shadowwar]

These are triggering because i believe of the empty forms. You can add an exclusion to your working path so files aren't picked up.

[rwan1]

I'm sorry, Rich, but I don't understand.  Are you speaking of "forms" in a sense other than how VB uses them?  There's only one such form in the sample I posted.  And am not familiar with the working path exclusion...not something that I've seen in VB.

Ron

[rwan1]

An additional bit of data.  I found another program I wrote in VisualBasic and compiled in 2014.  It's fairly complex, but it doesn't trigger the MalwareBytes warning.  Don't think I had MB back then.

So it appears to be only programs that are compiled under the newest version of MB.

 

Ron

[shadowwar]

The exclusion path would be added to malwarebytes so it doesnt hit the files.

https://support.malwarebytes.com/docs/DOC-1130

[rwan1]

Thanks, Rich...that did the trick.  I'll include the instructions for those MalwareBytes customers who use the program.

 

Ron

[shadowwar]

If these are commercial programs you can pm me and we can fix them. Also we are revising the detection routines to prevent more fps. Still a little bit of time out though before released. Hopefully by end of the month.