False Positives_Office 97

[DeanThompson]

Attached you will find the normal logs and developer logs per steps 1 and 4 of the instructions found here:  https://forums.malwarebytes.com/topic/3228-please-read-before-reporting-a-false-positive/

This has been occurring since the beginning of May that I'm aware of but since MWB's didn't update correctly yesterday, I had to reinstall today.

Let me know if you need additional information.

MWB_FalsePositiveLogs_052521.zip

[Porthos]

Hi,

Do you have "Use expert system algorithms to identify malicious files" enabled? It is located in Settings > Security> Scan option.

This is normally disabled by default.

[DeanThompson]

Yes.  I have that enabled.

 

[Porthos]

1 minute ago, DeanThompson said:

Yes.  I have that enabled.

 

Disable and scan again.

[AdvancedSetup]

Please disable it unless asked to enable by support

Thank you

 

[DeanThompson]

Disabled and scanning again.

For reference.  I normally scan once a month and I've had it on for a few months.

I'll let you know the results in about a half hour.

[Porthos]

Just now, DeanThompson said:

I normally scan once a month and I've had it on for a few months.

FYI. This setting is in the experimental stage.

That setting is to detect malformed files but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed you are able to tell the difference between a FP and a legit detection. 

And if you keep it on I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.

[DeanThompson]

Success.  No errors.

Thank You for the information and assistance.

[Porthos]

Just now, DeanThompson said:

Success.  No errors.

Thank You for the information and assistance.

Happy to assist.🙂