MachineLearning/Anomalous.95% just with a simple Visual Studio program

[DJFang]

Hello!

I've recently got more into the C# development in Visual Studio and I have discovered something quite annoying. As soon as you create a new project and add a PictureBox that has a gif image in it and you build it, the output executable is detected as MachineLearning/Anomalous.95%. Is there anything that can be done?

[miekiemoes]

Hi,

Can you zip and attach some of the executables that are detected, so we can have a look?

Please note, this is a machinelearning/generic detection, so it's still learning, hence why we need the files in order to finetune. Thx!

[DJFang]

testforanomalous.exe in the zip file is an exe where I have added a PictureBox with a gif and then removed it and anything that's related to any of these and it is still detected as anomalous.

WindowsFormsApp1.exe in the zip file is an exe where I have added a PictureBox and a gif (nothing removed from there).

anomalousdetections.zip

[miekiemoes]

Thanks, I'll forward this to our developer to see how this can be finetuned.

Additional note - for now, exclude the location where you compile these files from Malwarebytes detection.

 

[DJFang]

Thanks, can you let me know when there's something new related to this question? @miekiemoes

[miekiemoes]

I found a way how to finetune this already which might help in your case, however, I can't promise it will help for all.

This will be applied into next database update.

That's why, if you create a new project and it's with the goal to share later (in public), it's always a good idea to digitally sign the files + make sure there's good versioninfo that reflects your program/project (not from the default that is set by the compiler), as this always helps to prevent False Positives since the engine can learn faster on these. Keep in mind that other AVs (that use a machinelearning engine) would most probably detect this as well if otherwise.

Thanks!

[DJFang]

Thanks for the quick reply and the assistance! When is the next database update coming out?

Your tip did work (I had another application with similar issue I posted about the other day here) - I hadn't changed the AssemblyVersion and AssemblyFileVersion for a little while.

[miekiemoes]

Hi,

The next database is out already

[DJFang]

It's definitely the database update that has fixed it - thank you!