Falsely detects Gigabyte SSD Toolbox as "Malware.Heuristic.1003"

[DarthVitrial]

File attached. Run the installer (setup.exe) and Malwarebytes will block ISSetup.dll as a threat.

ssd_utility_ssd-tool-box_B21_0514.1.zip

 

Caused by expert system algorithms.

Edited May 18, 2021 by DarthVitrial

[cli]

Thanks for reporting, I just scanned the file and it's no longer detected.

[DarthVitrial]

Thanks.

It wasn't detected by scan, it was real-time detection with expert algorithms enabled, btw

[Porthos]

24 minutes ago, DarthVitrial said:

with expert algorithms enabled

That setting should be off by default.

It is to detect malformed files but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed you are able to tell the difference between a FP and a legit detection. 

And if you keep it on I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.

[Tovrin]

7 hours ago, Porthos said:

That setting should be off by default.

I've been getting "positive detection" (probably false positives" just about every second day.  They've mostly been setup files for installations, but it has been worrisome.  I've been thinking I've got something lurking in the background, though the scans come up clean, except for the things that are found and quarantined.

I've turned off this setting now.

[DarthVitrial]

here's the log, also

log.txt

[shadowwar]

This file was whitelisted on the 19th.