Probable false positives: Morrowind.exe, deadcells.exe and deadcells_gl.exe

[RID93]

Hey everyone! My Malwarebytes just found three files it deemed suspicious on my computer. They're all "Malware.Heuristic.1003".

I'm assuming the reason why it didn't find them before is that I recently set it to be as thorough as possible when doing a scan (checked the rootkit and "Use expert systems algorithms" options in my settings). For Morrowind.exe, it's not actually the vanilla file, I'm using the Morrowind Code Patch modification (and the Morrowind Graphics Extender XE mod, but I'm not sure that one matters in that context) so it's a modified version of the vanilla exe. Still, these mods are fairly well known and as far as I know, they're safe, so my guess is that it's a false positive. But better be cautious. ^^

As for the other two, they're .exes for a video game called Dead Cells available on Steam. They're perfectly vanilla and I have no reason to believe they're dangerous, so they're probably false positives.

Here's the log for my scan, and the .zip files for the .exes. I ran them through Virustotal too, but I'm not quite sure what to send you, it's the first time I do this. Don't hesitate to tell me what to send you if you think that will help. ^^

report.txt Morrowind.zip deadcells.zip deadcells_gl.zip

[Porthos]

18 minutes ago, RID93 said:

I recently set it to be as thorough as possible when doing a scan (checked the rootkit and "Use expert systems algorithms" options in my settings).

Turn off those settings and scan again.

Those settings are off by default especially "Use expert systems algorithms".

"Use expert systems algorithms" is to detect malformed files but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed you are able to tell the difference between a FP and a legit detection. 

And if you keep it on I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.

In either way, Staff will look into this and get this fixed.

Thanks for reporting!

Edited May 3, 2021 by Porthos

[shadowwar]

These files are whitelisted now but i recommend porthos advice. 

[RID93]

Just now, shadowwar said:

These files are whitelisted now but i recommend porthos advice. 

Yeah, I'm doing just that right now. I'll come back to you when it's done, but it's going to be a while. ^^

[RID93]

Scan is over, those three don't appear when the options are unchecked. Thanks again!