MachineLearning/Anomalous.96% False positive

[unknownguy]

So now I'm back to the situation where all my c# software get detected as MachineLearning/Anomalous.96%.
This happened to me before but was fixed. Now I can't make any software because it get detected as MachineLearning/Anomalous.96%.
I'm sorry but I have uninstalled Malwarebytes because I got really tired at this. Block after block and automatic removing.

How can this be fixed? I make software to people that pay me, now they think they are infected because of this.

[miekiemoes]

Hi,
 

I checked your software (from your older post) and downloaded it from here: https://github.com/capasha/eeditor/releases

I can't reproduce detection.

Please see here for more explanation:

 
Especially the bottom part, where it says: "

Also, If you are a developer, while building your application,  I suggest you exclude the working/building directory from detection via the exclusion settings in Malwarebytes. This since our Anomaly detection might possibly detect some of the files you are building.
Once the application/project is final and ready to be shared with others, in most cases it won't be detected anymore since it won't be triggered as "anomalous" anymore either.

In case a "final project" is still detected, please let us know (include the sample), so we can add it to our database of known good apps as well to prevent this in the future.

"

[unknownguy]

Looks like there is no more detections. I installed malwarebytes again and updated the database and now it's gone again. I saw another guy with similar problem. Thanks for the help.

[unknownguy]

I just released a tool in C#. And it got detected as MachineLearning/Anomalous.96% once again..
I added the zip to the program. It's a legit program.

[unknownguy]

I readed about MachineLearning/Anomalous and the file is packed. I need to pack it else it have too many files in the directory.

I pack my other open source program the same way, but it's never detected is that one whitelisted or somehow?

[unknownguy]

Here is the detection log and tool.

detected.zip

[unknownguy]

This is really pissing me off. Do I need to make a whitelist on all folders where I make C# programs inside?

Now did it detect this behavior again, but now it added it into quarantine and now I can't stop it from removing it because I need to restart my computer.

I need to compress my files because of having 50 images in the same folder as the program or 10 dll files is not good. Then I need to check so the images and dll files doesn't get deleted and if a user delete them, then they need to redownload the file again. I see it better in compressing it.

There must be a way to exclude Malwarebytes from even touching when I debug or compile my C# programs. 

[miekiemoes]

Hi,

I merged your threads.

Is above a final project? In either way, I whitelisted that one.

If it's not a final project (still in development), then I suggest you temporary disable the machinelearning detection while developing/working on it.

Once it's final, then enable machinelearning detection for it, see if it's being detected and if it is, then share it with us, so we can add to our machinelearning (as non malicious) after verifying.

This is where you can temporary disable the signature-less generic detection:

[unknownguy]

I wonder if there is some way to disable Anomaly detection in 1 hour or so, then it will be enabled again?
It's not that I'm going to remember that I have disabled this.

[miekiemoes]

No, we don't have this, but this is actually a very good idea, so I will request this feature for a future release.