C# program flagged as malware. False positive

[Lellson]

Hello,

I wrote a program which creates music sheets from a MIDI file (written in C# with WPF) for a company.

After I sent the first test version to the company I got a reply that Malwarebytes flags the program as malware (MachineLearning\/Anomalous.100%).

This is obviously a false positive and I wanted to ask how to fix this.

I already tried to remove or change some parts of the code but without success.  

It would be really helpful if someone could look at my logs and tell me what I've done wrong (I'll attach them). I sadly can't upload the source code to this public forum, but I could send it to you privately if you need it.

 

Thanks a lot!

Lell

malwarebytes LOG.zip mbst-grab-results.zip

[cli]

We'll need the file in question in order to review.

[Lellson]

 

18 minutes ago, cli said:

We'll need the file in question in order to review.

Which files do you mean? The source code?

Thanks!

[Lellson]

27 minutes ago, cli said:

We'll need the file in question in order to review.

oh you mean the executable? Sorry.

MidiToSheet.zip

[thisisu]

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

This should be fixed by now. Please give it some time (max 10 minutes) in order to have it populate, so detection won't happen anymore.

If still detected on your end after ~10 minutes from now. Perform the following steps: 

1. Totally exit/shutdown Malwarebytes.
2. Go to here in explorer: C:\ProgramData\Malwarebytes\MBAMService
3. Delete the following file only: hubblecache
4. Then you can restart MBAM and the cache file will rebuild on the next scan.

[Lellson]

20 hours ago, thisisu said:

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

This should be fixed by now. Please give it some time (max 10 minutes) in order to have it populate, so detection won't happen anymore.

If still detected on your end after ~10 minutes from now. Perform the following steps: 

1. Totally exit/shutdown Malwarebytes.
2. Go to here in explorer: C:\ProgramData\Malwarebytes\MBAMService
3. Delete the following file only: hubblecache
4. Then you can restart MBAM and the cache file will rebuild on the next scan.

Thanks a lot!

[thisisu]

You're welcome