Not sure if I have trojan or false positive from free VST

[diamidolphinz]

I downloaded a vst plugin from the following page

https://plugins4free.com/plugin/3305/

Plugins4free has been mostly reliable and the download didn't trigger my browser guard, but when I scanned the zip file in MWB premium it was flagged as Malware.Heuristic.1003 and quarantined, which is apparently a rootkit detection, but also has a lot of false positives.

I'd upload the logs but I disconnected my computer from the internet fairly quickly afterwards and don't really want to connect other devices to it right now. I scanned my desktop and nothing came up but I'm not sure it if might have installed itself on my PC or altered my security, as even though it was detectef by a scan it wasn't initially when downloaded.

What should I do? My stuff is already backed up but I'd rather not wipe my OS if its a false alarm.

[kevinf80]

Hiya diamidolphinz and welcome to Malwarebyes,

Can you attach the zip file to your next reply, I`ll check it out and see if its an FP or not...

Thank you,

Kevin.

[diamidolphinz]

Is it safe to redownload and attach the zip file to my current device? I don't want two things to be infected...

[Porthos]

39 minutes ago, diamidolphinz said:

but when I scanned the zip file in MWB premium it was flagged as Malware.Heuristic.1003 and quarantined, which is apparently a rootkit detection, but also has a lot of false positives.

Hi,

Do you have "Use expert system algorithms to identify malicious files" enabled? It is located in Settings > Security> Scan option.

This is normally disabled by default. Please turn it back off.

FYI. This setting is in the experimental stage.

That setting is to detect malformed files but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed, you are able to tell the difference between a FP and a legit detection. 

And if you keep it on, I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks