Jump to content

False positive for Rufus 3.13.1735 (Windows Store x64 version)


Recommended Posts


Per https://www.virustotal.com/gui/file/87a9f99f0cc5bc2773990ae1b5e033e6fae83ae478041f044db8791597b86ad4/detection, Malwarebyte is currently detecting the Windows Store version of the Rufus 3.13 x86_64 executable (installable from https://www.microsoft.com/en-us/p/rufus/9pc3h3v7q9ch) as containing Malware.AI.17536672.


However, the non-Store release of Rufus 3.13 (which is x86_32) does not suffer the same detection (https://www.virustotal.com/gui/file/ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb/detection) and, since the application is fully Open Source, we can also detail that the changes that were applied to the executable, from the non-detected non-Store release, stand in the 5 last commits listed at https://github.com/pbatard/rufus/commits/appstore.

In other words, the exact source for the executable that Malwarebyte currently classifies as containing Malware.AI.17536672 can be found at https://github.com/pbatard/rufus/tree/85cd19eb76f3c277d0f0593407926477dafc52a5.

Therefore, if this isn't a false positive, and considering that a version 5 commits prior is not triggering any detection, it should be easy to point out what in the code should be construed as malware.

If not, I would kindly request Malwarebyte to fix their engine, so as not to trigger a false positive for the Windows Store version of that application.




Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.