Thronic Posted October 30, 2018 ID:1278292 Share Posted October 30, 2018 I wonder why these are triggered at 100 and 96%. I recently renamed the project, but I've changed GUID and all the references I can think of. Granted it's not signed, but neither is any of my other C# applications and they're all good, similar size and algorithms. Please provide hints and tips of how I can avoid this detection in the future. Virustotal gives me 0 hits. I'm not sure why yours gives me 96-100%. Thanks. mbamreport.txt Klar.zip Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 30, 2018 Staff ID:1278294 Share Posted October 30, 2018 Hi, Thanks for reporting this to us. To clarify this some more, our machinelearning engine detects as "Anomalous", not really malware. So that means, it triggers on some anomaly design, unfinished builds, sections where the entropy is quite high (in your case, the .text section has a high entropy in combination with the rest of the file - might be because of the Compiler/Packer), etc etc... Reporting this helps the machinelearning engine to train on your files faster, so it won't be detected anymore (including future updates). Thanks!!! Link to post Share on other sites More sharing options...
Thronic Posted October 30, 2018 Author ID:1278296 Share Posted October 30, 2018 Thank you, that was quick. Link to post Share on other sites More sharing options...
Thronic Posted October 31, 2018 Author ID:1278495 Share Posted October 31, 2018 It's back again. Trying to clean up source, resources, etc. to avoid this .text entropy issue. Extremely annoying by now. Link to post Share on other sites More sharing options...
Thronic Posted October 31, 2018 Author ID:1278510 Share Posted October 31, 2018 I had changed some version details, changed them back and seems good again. As a weird sidenote. I stripped a lot of autogenerated text from the project files to see if the % would go down, but it actually increased from 96% to 97%. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 31, 2018 Staff ID:1278520 Share Posted October 31, 2018 Hi, I have sent you a private message via this forum to give you some more insight Link to post Share on other sites More sharing options...
pctechnologiesmd Posted October 31, 2018 ID:1278666 Share Posted October 31, 2018 I have the same issue with this installer: https://sim.djicdn.com/Launcher/Launcher2_1_0_0__2018_10.exe Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 31, 2018 Staff ID:1278667 Share Posted October 31, 2018 Hi, This is different from above, but I'll look into this if verified as legitimate and add it to our machinelearning engine to train on, so it won't get detected anymore. Thanks for reporting! Link to post Share on other sites More sharing options...
pctechnologiesmd Posted October 31, 2018 ID:1278668 Share Posted October 31, 2018 Yes, it is different. Please get back to me when you have an answer. Thank you. I uninstalled the program and will wait for your feedback. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 31, 2018 Staff ID:1278669 Share Posted October 31, 2018 It looked quite suspicious, but after extra analysis, it was non malicious Link to post Share on other sites More sharing options...
pctechnologiesmd Posted October 31, 2018 ID:1278670 Share Posted October 31, 2018 Thank you!! Link to post Share on other sites More sharing options...
pctechnologiesmd Posted October 31, 2018 ID:1278672 Share Posted October 31, 2018 When will the database be updated so the program can be run without adding to the exclusions list? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 31, 2018 Staff ID:1278673 Share Posted October 31, 2018 It's effective right now already - as, once we add it to our engine for learning, changes are applied immediately Link to post Share on other sites More sharing options...
pctechnologiesmd Posted October 31, 2018 ID:1278674 Share Posted October 31, 2018 Hmmm...i will try to update again and see what happens. Still being blocked Link to post Share on other sites More sharing options...
pctechnologiesmd Posted October 31, 2018 ID:1278675 Share Posted October 31, 2018 Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 31, 2018 Staff ID:1278678 Share Posted October 31, 2018 (edited) Hmm, do you still have this detection after a reboot? (or after quitting mbam and restarting it again?) Because it could be because it was still in memory. Edited to add, it's probably a caching issue. I had others verify on the same file and they didn't get a detection, so it should be OK again afterwards. Edited October 31, 2018 by miekiemoes Link to post Share on other sites More sharing options...
pctechnologiesmd Posted October 31, 2018 ID:1278680 Share Posted October 31, 2018 Yes, rebooted and still shows Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 31, 2018 Staff ID:1278681 Share Posted October 31, 2018 Ok, give it some time, as it might be a caching issue on your end. If it still shows the same tomorrow, please do the following: Quit malwarebytes from the systemtray. Then navigate to the following folder: C:\ProgramData\Malwarebytes\MBAMService In there, locate the file HubbleCache and delete it. Restart Malwarebytes again. A new Hubblecache will then be created again, so it will properly pick it up and remember to not detect this anymore. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now