Scrivener false positive

[Slowman]

Hi - I've had Scrivener on my PC for years but recently MWB has started flagging a registry entry and the uninstaller:

Malware.Heuristic.1003, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Scrivener 1980
Malware.Heuristic.1003, C:\PROGRAM FILES (X86)\SCRIVENER\UNINSTALL.EXE

Has this word processing software really gone rogue even without any updates for years?

[Porthos]

1 minute ago, Slowman said:

Hi - I've had Scrivener on my PC for years but recently MWB has started flagging a registry entry and the uninstaller:

Malware.Heuristic.1003, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Scrivener 1980
Malware.Heuristic.1003, C:\PROGRAM FILES (X86)\SCRIVENER\UNINSTALL.EXE

Has this word processing software really gone rogue even without any updates for years?

Hi,

Do you have "Use expert system algorithms to identify malicious files" enabled? It is located in Settings > Security> Scan option.

This is normally disabled by default.

[Slowman]

2 hours ago, Porthos said:

Hi,

 

Do you have "Use expert system algorithms to identify malicious files" enabled? It is located in Settings > Security> Scan option.

 

This is normally disabled by default.

 

Yes, that's already on. All Scan Options there are set to ON.

[Porthos]

5 hours ago, Slowman said:

Yes, that's already on.

Turn it off.

It is to detect malformed files but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed you are able to tell the difference between a FP and a legit detection. 

And if you keep it on I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.

[shadowwar]

If you zip and attach this file i can add it to the whitelist.

 

C:\PROGRAM FILES (X86)\SCRIVENER\UNINSTALL.EXE

[Slowman]

Great, thanks Rich

uninstall.zip