False positive Fractal Audio Systems ucore.exe

[Daveis]

ucore_false_positive.txt ucore.zip

[Porthos]

Hi,

Do you have "Use expert system algorithms to identify malicious files" enabled? It is located in Settings > Security> Scan option.

This is normally disabled by default.

In either way, Staff will look into this and get this fixed.

Thanks for reporting!

FYI

That settind is to detect malformed files but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed you are able to tell the difference between a FP and a legit detection. 

And if you keep it on I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.

[Daveis]

I did have "Use expert system algorithms to identify malicious files" enabled.  With it disabled it no longer flags the file.

[miekiemoes]

This file has been whitelisted in a meanwhile as well.

[Nobunaga]

Looks like this false positive has returned in ucore.exe from my Cambridge Audio USB driver.

[Porthos]

2 hours ago, Nobunaga said:

Looks like this false positive has returned in ucore.exe from my Cambridge Audio USB driver.

Please zip the affected and attach it here. Also attach the log as well.

[Nobunaga]

Thanks for the quick response.  Find attached the exe and log...

ucore.zip ucore.exe.txt

[Porthos]

2 minutes ago, Nobunaga said:

Find attached the exe and log...

Quote

Malware.Heuristic.1003

Hi,

Do you have "Use expert system algorithms to identify malicious files" enabled? It is located in Settings > Security> Scan option.

This is normally disabled by default.

Please turn off "Use expert system algorithms to identify malicious files” It is located in Settings > Security> Scan option to avoid these detection's

 

In either way, Staff will investigate this and get this fixed.

Thanks for reporting! It helps tune this experimental setting.

[Nobunaga]

Hi Porthos,

I just put the file in my "Allow List".  Hope that's as safe?

Thanks!

[Porthos]

16 minutes ago, Nobunaga said:

Hi Porthos,

I just put the file in my "Allow List".  Hope that's as safe?

Thanks!

That of course will work but the setting I mentioned should be off until it is out of the experimental stage and enabled by default.

[miekiemoes]

I've whitelisted this one as well.

[Nobunaga]

Thank you both!  I've removed the file from my "Allow List" and switched off that setting.