SPFLite2 false positives

[Porthos]

1 minute ago, BillH99999 said:

I guess I still don't understand.  I thought it was only detected because I had "Use expert system algorithms to identify malicious files" enabled.  Why would the database version make any difference - or- does this option rely on the database for it's detections?

Bill

Database updates also update heuristic detection's as this is also a heuristic detection hence the name Malware.Heuristic.1003

The 1xxx in the detection name tells us it is a expert system algorithms detection.

[BillH99999]

OK... thanks.  In any case I have turned that option off so hopefully won't run into this situation again.

Thanks,
Bill

[shadowwar]

most of the whitelisting for heuristics are cloud based and its mostly self learning. 

Basically the way the expert system is intended for is say malwarebytes detects an infection without it on. You can turn that on to scan with aggressive heuristics to see if there are any zero day files that may not be detected. But there can be fps being of the aggressive nature of it.