SharpScript - MachineLearning/Anomalous.100%

[BMenees]

I'm the developer of SharpScript.  It's a .NET scripting engine that dynamically compiles C# script files (using the Roslyn compiler or the CodeDom) and executes them.  This is a free, open source app that's been available since 2004.  Suddenly, MalwareBytes is calling it malware.  I'm guessing your new heuristic flags anything that's using Roslyn or the CodeDom to compile and execut e code, but it's a bit heavy-handed to assert that it's 100% malware.  Please whitelist SharpScript.  It's not digitally signed, and I update it once or twice a year.  I've attached the scan log and the SharpScript51.zip file that MBAM is complaining about.  Note that the SharpScript51.zip file also contains the full source code to the product, so you can see everything it does.

SharpScript51.zip

ScanLog.zip

[miekiemoes]

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

I however can't reproduce detection anymore. Is the detection still happening on your end?

[BMenees]

I've removed my exclusion for it.  Now it's not happening when I rescan just that file nor when I do a full system scan.

[miekiemoes]

Ok, so no detection is occurring anymore, so that means it has learned from it already.