Harry Potter False Positive?

[Hal-Sendo]

Read the instructions, but not sure I'm doing this right...  Here goes.

Downloaded Harry Potter Game.  The .exe is coming up as Heuristic Virus on Norton, and TrojanGen8 Cloud.

Malwarebytes flags it as MachineLearning/Anomalous.100%

Log details below

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/13/20
Scan Time: 8:05 PM
Log File: af4a007e-7db9-11ea-ae4a-00137792124e.json

-Software Information-
Version: 4.1.0.56
Components Version: 1.0.867
Update Package Version: 1.0.22404
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: lewis-PC\lewis

-Scan Summary-
Scan Type: Custom Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 389
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 1 min, 28 sec

-Scan Options-
Memory: Disabled
Startup: Disabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
MachineLearning/Anomalous.100%, C:\GAMES\HARRY_POTTER_AND_THE_PHILOSOPHERS_STONE_WIN_FILES_EN\GAME FILES\SYSTEM\HP.EXE, No Action By User, 0, 392687, 1.0.22404, , shuriken,

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

MBAM Threat Removal.txt HP Threat Removal Results.txt

[cli]

Can you attach the detected file? Thanks.

[Hal-Sendo]

I attempted to attach the detected file, but it wasn't allowed, as it is an .exe file...

[cli]

Please attach it as a ZIP or RAR file. Thanks.

[Hal-Sendo]

Right, here you are.

Have attached the HP.exe file as Zip and also the System file the .exeis found in.

HP.rar HP System.rar

[Hal-Sendo]

Thanks very much for getting back to me by the way.    From doing some research I'm thinking it may be because it is a 'cracked' file to facilitate play on Windows 10.  But i obviously wnat to besure before I take any risk.  let me know you're thoughts.  Thanks

[Hal-Sendo]

On 4/14/2020 at 5:45 PM, cli said:

Please attach it as a ZIP or RAR file. Thanks.

Hi there,

Did those files work ok?

[shadowwar]

This should be fixed now. Thanks for reporting.

[Hal-Sendo]

33 minutes ago, shadowwar said:

This should be fixed now. Thanks for reporting.

Ok great.  When you say 'fixed', how do you mean?  Was it a safe file and just a scanning issue? Sorry, I don't know much about Viruses and the like.  And I want to be sure before I go on.

I did run the game yesterday for a while and Malwarebytes detected 4 MachineLearning/Anomalous.100%, all do do with the File and Process relating to HP.exe - is this worrying at all?

 

 

[Hal-Sendo]

Also, in Task Manager, there seemed to be 2 HP.exe processes running...  First one starts when I click the game, but the game doesn't launch.  Then, when I click it again the second one appears and the game launches - and concerns?

[shadowwar]

This was an incorrect detection by us and we removed the detection. That is what a false positive means.

 

[Hal-Sendo]

Yeah, absolutely.  I just wasn't sure if you investigate the file, and check its safe? So nothing malicious, and good to go?  Any idea why it flagged up?

[shadowwar]

Because the author used a packer of the exe that is mostly used against malware to hide code.

[Hal-Sendo]

Ok, thanks. So then you check the file for hidden code, and found nothing? 

[Hal-Sendo]

6 minutes ago, Hal-Sendo said:

Ok, thanks. So then you check the file for hidden code, and found nothing? 

Sorry for all the questions that's the last one i promise!  I appreciate you taking the time to help me

[shadowwar]

I am sorry but i cant get into how we classify. But the file is non malicious.

[Hal-Sendo]

That's absolutely fine, I understand.  That's the confirmation I wanted :-) Thanks again very much!!

 

[Hal-Sendo]

Hello again,

Sorry, but I did another scan of my computer with a new version of the files, and Malwarebytes picked up on HP.exe again.  I have re-attached the file.  Would you be able to double check? Or will it still pick up on the scans?

HP.rar

[shadowwar]

Showing still fixed on my end. Please do this.

 

Quit malwarebytes from the systemtray.
Then navigate to the following folder:

C:\ProgramData\Malwarebytes\MBAMService

In there, locate the file HubbleCache and delete it.

Restart Malwarebytes again. A new Hubblecache will then be created again, so it will properly pick it up and remember to not detect this anymore.

[Hal-Sendo]

Hi, thanks for getting back to me so quickly.  This seems to have worked, thanks very much!