gotek Posted January 21, 2021 ID:1433627 Share Posted January 21, 2021 My software 'Advance BAT to EXE converter' creates EXE files from BAT files. It does not do any harm to computers or data. Malwarebytes falsely detect my program and EXEs created by it as "MachineLearning/Anomalous.100%" I sell this software and my paid customers are annoyed with these false positives. This zip file contains a sample of batch files compiled to EXE with 'Advanced BAT to EXE Converter' and there are thousands of variations of these files. Anything close to these files must NOT be a false positive. i have included compiled batch scripts in "COMPILED Batch Files" folder. And i have included my compiler program files in "COMPILER" folder. The compiled EXE are created from "bfchlp1.dat" and "bfchlp4.dat" from "Specially flagged files" folder with the encrypted batch file append at the end, There are also few bytes overwrite inside of the "bfchlp" files. Can you please fix this? i have attached files and virustotal.com link virustotal link : https://www.virustotal.com/gui/file/68d738fc849b1b6da8f62f8e58e928f2049c92b5ec7935498e8cf641ee3c91da/detection The sample is in a password protected zip file The password for the attachment is infected FP421_password_infected.zip Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 21, 2021 Staff ID:1433633 Share Posted January 21, 2021 Hi, This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Also see here for more explanation: https://forums.malwarebytes.com/topic/238670-machinelearninganomalous-detections-and-explanation/ Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore. This should be fixed by now. Please give it some time (max 10 minutes) in order to have it populate, so detection won't happen anymore. Link to post Share on other sites More sharing options...
gotek Posted January 22, 2021 Author ID:1433832 Share Posted January 22, 2021 12 hours after your fix, it is still falsely detected at virustotal.com https://www.virustotal.com/gui/file/68d738fc849b1b6da8f62f8e58e928f2049c92b5ec7935498e8cf641ee3c91da/detection can you please elaborate on this? Link to post Share on other sites More sharing options...
Porthos Posted January 22, 2021 ID:1433833 Share Posted January 22, 2021 6 minutes ago, gotek said: 12 hours after your fix, it is still falsely detected at virustotal.com https://www.virustotal.com/gui/file/68d738fc849b1b6da8f62f8e58e928f2049c92b5ec7935498e8cf641ee3c91da/detection can you please elaborate on this? The engine format and configuration in VirusTotal is different than our consumer and corporate products’ default configuration. In VirusTotal we use a command-line engine with different configuration and detection techniques/heuristics which might detect more than the commercial product. There are also false-positive suppression mechanisms in the commercial product which are not present in the command-line engine in VirusTotal. This file has been whitelisted for our commercial products and it is not detected anymore. Link to post Share on other sites More sharing options...
gotek Posted January 22, 2021 Author ID:1433834 Share Posted January 22, 2021 Alright. Thank you very much! Link to post Share on other sites More sharing options...
gotek Posted January 25, 2021 Author ID:1434438 Share Posted January 25, 2021 can you check these new files and confirm they are not false positives? On 1/22/2021 at 7:11 AM, Porthos said: The engine format and configuration in VirusTotal is different than our consumer and corporate products’ default configuration. In VirusTotal we use a command-line engine with different configuration and detection techniques/heuristics which might detect more than the commercial product. There are also false-positive suppression mechanisms in the commercial product which are not present in the command-line engine in VirusTotal. This file has been whitelisted for our commercial products and it is not detected anymore. FP_password_infected.zip Link to post Share on other sites More sharing options...
Porthos Posted January 25, 2021 ID:1434442 Share Posted January 25, 2021 I did not get a detection but @miekiemoes can verify. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 25, 2021 Staff ID:1434443 Share Posted January 25, 2021 Hi, I don't get a detection on any of the files attached. Link to post Share on other sites More sharing options...
gotek Posted January 25, 2021 Author ID:1434445 Share Posted January 25, 2021 19 minutes ago, miekiemoes said: Hi, I don't get a detection on any of the files attached. 23 minutes ago, Porthos said: I did not get a detection but @miekiemoes can verify. thanks guys! Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now