False Positive of Dark Forces Mouselook

[Karjala]

Hi, Malware Bytes is falsely flagging a Dark Forces Mouselook / Key Rebind mod. 

Inside the zip is DFORCEDH.EXE that is falsely flagged as a virus by MalwareBytes. In fact, it is he only AV (Out of 65) flagging it as you can see here --> https://www.virustotal.com/gui/file/81eaebcb58fee55f46bf54bc876929654fbb653bcfbaa1883f8bd65d634e58f2/detection 

It is a legit program, lots of people have been using it over the past month --> https://steamcommunity.com/sharedfiles/filedetails/?id=2311190593

 

What does it do? 

 

It adds mouselook and rebind controls for DARK.EXE / JEDI.CFG files in the game directory. First if looks up in the registry where the game is installed. Then it loads the executable and files and uploads them. There is a 32-bit/16-bit version in a single  executable for dosbox compatibility --> https://www.dosbox.com/wiki/GAMES:Star_Wars:_Dark_Forces

 

It is not a virus because it doesn't have any network library imports so it cannot replicate iitself or phone-home any network locations.  

 

Please review this, I will be happy to answer any questions. 

Thanks! 

dforcedh.zip

Edited January 21, 2021 by AdvancedSetup
corrected font issue

[cli]

Our engine format and configuration in VirusTotal is different than our consumer and corporate products’ default configuration. In VirusTotal we use a command-line engine with different configuration and detection techniques/heuristics which might detect more than the commercial product. There are also false-positive suppression mechanisms in the commercial product which are not present in the command-line engine in VirusTotal.

This file has been whitelisted for our commercial products and it is not detected anymore.

Edited January 21, 2021 by AdvancedSetup
corrected font issue