Multiple uninstaller false positives?

[valuable_exercise]

Hello,

I've done multiple scans in the past few days with zero results, however today I had these files/reg keys come up as malware.sandbox.4. Are these FP's? I haven't downloaded anything different.

 

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/2/21
Scan Time: 2:36 AM
Log File: 8e644072-4cd5-11eb-96a0-b06ebf3027d5.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1130
Update Package Version: 1.0.35161
License: Trial

-System Information-
OS: Windows 10 (Build 19041.685)
CPU: x64
File System: NTFS
User: DESKTOP-QNS5IPH\Jake

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 362863
Threats Detected: 5
Threats Quarantined: 0
Time Elapsed: 3 min, 34 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 3
Malware.Sandbox.4, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{08D3C5BB-C492-4916-B111-725081845380}_is1, No Action By User, 4, 0, , , , , ,
Malware.Sandbox.4, HKU\S-1-5-21-1928947853-3746489769-2301475211-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\RuneLite Launcher_is1, No Action By User, 4, 0, , , , , ,
Malware.Sandbox.4, HKU\S-1-5-21-1928947853-3746489769-2301475211-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\RuneLite_is1, No Action By User, 4, 0, , , , , ,

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 2
Malware.Sandbox.4, C:\USERS\JAKE\APPDATA\ROAMING\STREAMLABS\STREAMLABS CHATBOT\UNINS000.EXE, No Action By User, 4, 0, 1.0.35161, 4, dds, 01054529, 87E19129698030A9E4D9CC7C01D00D3A, BFA41864A66152BC22DB1E728E56339457C785C498AE84AE39DC67DAF22EB964
Malware.Sandbox.4, C:\USERS\JAKE\APPDATA\LOCAL\RUNELITE\UNINS000.EXE, No Action By User, 4, 0, 1.0.35161, 4, dds, 01054529, C8E3BE4A60011CA59BB247F90C7F6E6F, 8CDA3A2B3DBD6DEA81801D500E4FDADE70CA39DAEC7A21A5EB94C1E65C983DB5

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[miekiemoes]

Hi,

This is indeed a false positive by our additional machinelearning engine we have implemented.
This will get fixed.

Thanks for reporting!

[valuable_exercise]

Just now, miekiemoes said:

Hi,

This is indeed a false positive by our additional machinelearning engine we have implemented.
This will get fixed.

Thanks for reporting!

Thank you so much for the quick reply and explanation.

[SevFTW]

Had the same issue today, false positives in the RuneLite Launcher:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/22/22
Scan Time: 3:51 PM
Log File: 6c65933c-09c5-11ed-878f-00d8619dd6eb.json

-Software Information-
Version: 4.5.10.200
Components Version: 1.0.1709
Update Package Version: 1.0.57584
License: Premium

-System Information-
OS: Windows 10 (Build 19044.1826)
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 344992
Threats Detected: 2
Threats Quarantined: 0
Time Elapsed: 6 min, 46 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 1
Malware.Sandbox.1, HKU\S-1-5-21-4255058923-2706458107-1875295977-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\RuneLite Launcher_is1, No Action By User, 1, 0, , , , , , 

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Malware.Sandbox.1, C:\USERS\SEVER\APPDATA\LOCAL\RUNELITE\UNINS000.EXE, No Action By User, 1, 0, 1.0.57584, 1, dds, 01869844, 8731D84EF2E516BC908290AC584D20BB, 9DB4AAAFFEBEA2552EA4288F47ED0E0691F1B20A8B4CD4C8487C5EB83407371C

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

 

[shadowwar]

This has been whitelisted. In the future best to start a new thread then use an old one. This so we can provide a faster response. 

Edited July 23, 2022 by shadowwar