Jump to content

Keyboard Driver False Positive?


Recommended Posts


I scanned my PC after an update and Malwarebytes detected a file called 11DCF31E.msi located in C:\WINDOWS\INSTALLER as Malware.Heuristic.1003 during a scan. I think it may be a false positive.

According to file properties it's the ROCCAT Roys Keyboard Driver which makes sense as I am actually using a Roccat keyboard, although the file name seems to be spelled wrong (Ryos is the correct name of the keyboard and not Roys) but I guess that may very well be a typo. It's digitally signed by the manufacturer Roccat GmbH but the signature is invalid according to Windows (valid to Aug 22 2020).

Another reason why I think it's a false positive is that it was only detected by version and after updating to it no longer detects it, same on VirusTotal which probably uses a recent version too. I wasn't really sure why an older version would detect it though, considering it updates definitions before scans as far as I understand?

As described in the pinned post I've attached the log and the detected file in a zip archive.


mbreport-12-21.txt detected_file_12-21.zip

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.